DF-3641 — bnx_sysctl_std_refill tx/rx ring-count copy-paste — evidence pack

What: the handler for dev.bnx.N.std_refill (sys/dev/netif/bnx/if_bnx.c:5684-5685) runs for (i = 0; i < sc->bnx_tx_ringcnt; ++i) sc->bnx_rx_ret_ring[i].bnx_rx_cntmax = cntmax; — the loop bound is a copy-paste from a TX loop and must be sc->bnx_rx_retcnt. With rx_retcnt > 1, tx_ringcnt == 1 (common BCM5719/ 5720 RSS topology) only ring 0 is updated. The validation at 5679 also admits negative cntmax, which truncates into the uint16_t field.

Impact: configuration correctness only — tx_ringcnt <= rx_retcnt is structurally guaranteed (if_bnx.c:5784-5799 + sys/net/if.c:3944-3953), so there is no OOB; root-only sysctl. Filed Info / base:dev.

Reproduce (audit guest — honest negative):

  cc -O -Wall -o trigger trigger.c     # guest; builds clean
  ./run.sh                             # via dfbsd-qemu/vm.sh run_root

run.log: dev.bnx.0.std_refill → unknown oid (no Broadcom hardware), plus a verbatim guest-side dump of lines 5679-5686 showing the wrong bound; src md5 matches the audited tree → runtime verdict inconclusive (source-level certainty).

On real hardware: sysctl dev.bnx.0.rx_rings=4-style setup with 1 TX ring, write dev.bnx.0.std_refill=64 — rings 1..3 keep the default (512/4)/4 = 32.

Fix: fix.diff — iterate bnx_rx_retcnt, reject cntmax < 1 (git-apply verified).

Files: VERDICT.md (full narrative + structural tx<=rx proof), trigger.c, build.sh/run.sh, build.log/run.log (untrimmed guest transcripts), env.txt, manifest.json, verdict.json.

DF-3641 — bnx_sysctl_std_refill() iterates bnx_tx_ringcnt while indexing bnx_rx_ret_ring[]

File: sys/dev/netif/bnx/if_bnx.c (pass 2, GLM 5.3) Class: copy-paste loop-bound defect (CWE-193-adjacent; here correctness only) Severity filed: Info, bucket base:dev, confidence certain (source fact) Verdict: inconclusive at runtime — sysctl node requires attached bnx hardware, absent on the audit guest.

1. Root cause (path:line)

bnx_sysctl_std_refill() — the handler for dev.bnx.N.std_refill:

• sys/dev/netif/bnx/if_bnx.c:5669 — reads ret = &sc->bnx_rx_ret_ring[0] (an RX return ring)
• sys/dev/netif/bnx/if_bnx.c:5679 — validates (cntmax * sc->bnx_rx_retcnt) >= BGE_STD_RX_RING_CNT / 2 → EINVAL
• sys/dev/netif/bnx/if_bnx.c:5684 — for (i = 0; i < sc->bnx_tx_ringcnt; ++i) ← wrong count
• sys/dev/netif/bnx/if_bnx.c:5685 — sc->bnx_rx_ret_ring[i].bnx_rx_cntmax = cntmax;

The loop must run over sc->bnx_rx_retcnt. On the common BCM5719/5720 RSS setup with rx_retcnt > 1 and tx_ringcnt == 1 (the non-bundled topology; bnx_setup_ring_cnt() allows tx counts from 1..min(4, rx_retcnt)), a write to dev.bnx.N.std_refill updates only ring 0 — rings 1..rx_retcnt-1 silently keep the default bnx_rx_cntmax assigned in bnx_dma_alloc() (if_bnx.c:4259-4260: (BGE_STD_RX_RING_CNT / 4) / sc->bnx_rx_retcnt), so the operator-visible value disagrees with the per-ring refill thresholds actually in force (used at if_bnx.c:2825, ret->bnx_rx_cnt >= ret->bnx_rx_cntmax).

2. Not memory-unsafe (why Info)

tx_ringcnt <= rx_retcnt is structurally guaranteed before any of this code runs: bnx_setup_ring_cnt() (if_bnx.c:5784-5799) clamps the TX ring map to min(BNX_TX_RING_MAX, rx_retcnt) and if_ringcnt_fixup() (sys/net/if.c:3944-3953) clamps the count; the KASSERT at if_bnx.c:5797 documents the invariant (if_ringmap_align() only equalizes CPU grids, not counts — verified in sys/net/if.c:4029-4036). The loop therefore can never run past the bnx_rx_ret_ring[] allocation.

Related wart (also fixed in fix.diff): the validation at 5679 admits negative cntmax (n * retcnt is negative, never >= 256), which then truncates into the uint16_t bnx_rx_cntmax (if_bnxvar.h:204) — e.g. −5 → 65531, making the bnx_rx_cnt >= bnx_rx_cntmax test at 2825 almost never fire (refill scheduling from that path stops; RX still refills via the independent bnx_rx_std_used >= BGE_STD_RX_RING_CNT/2 check at 2890). Root-only sysctl, performance/correctness only.

3. Guest evidence (why inconclusive)

run.log (guest, byte-identical source): - pci/if_bnx in kernel; NO_BROADCOM_DEVICE; ifconfig -l = vtnet0 lo0; sysctl dev.bnx.0.std_refill → unknown oid → the handler never executes on this guest. - Guest-side dump of lines 5679-5686 shows the mismatch verbatim. - md5 if_bnx.c == audited tree.

trigger.c probes dev.bnx.0.std_refill via sysctlbyname and correctly reports it absent on the guest → honest inconclusive / reproduced: 0.

4. Fix

fix.diff — iterate sc->bnx_rx_retcnt and reject cntmax < 1. git-apply-able (verified). Not runtime-validatable on this guest (fix_status: not_testable).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.