DF-3718 — mxge_tx_done() walks the TX ring toward an unvalidated NIC completion counter

Vulnerability

sys/dev/netif/mxge/if_mxge.c mxge_tx_done() (:2364-2415):

while (tx->pkt_done != mcp_idx) {        /* :2369 */
        idx = tx->done & tx->mask;
        tx->done++;
        m = tx->info[idx].m;
        if (m != NULL) {                  /* first-segment slots only */
                tx->pkt_done++;
                ...
                bus_dmamap_unload(tx->dmat, tx->info[idx].map);
                m_freem(m);               /* :2386 */
        }
}

mcp_idx is (int)send_done_count — the firmware statistics block's packet-completion counter, NIC-DMA'd data (mcp_irq_data_t.send_done_count, mxge_mcp.h) — read at :2695/:2767/:2844 and passed from all three interrupt paths (mxge_legacy :2699, mxge_msi :2770, mxge_msix_rxtx :2847). There is no bound relating mcp_idx to tx->pkt_done/tx->req:

1. Free of unsent descriptors (DMA-after-free). A counter even a few packets ahead makes the loop walk forward, unloading dmamaps and freeing mbufs for descriptors that are still queued-but-unsent. The NIC keeps owning those DMA mappings → post-free DMA reads of freed mbuf memory (content disclosure to the wire / corruption), the same shape as DF-3714 (em tx_collect) and DF-3680 (igb txeof).
2. Infinite interrupt-context spin. pkt_done only advances on non-NULL info[idx].m; after one full ring revolution every slot has m == NULL, pkt_done freezes, and if the NIC's counter still doesn't match (garbage, desync), the while spins forever — holding tx->tx_serialize (entered at :2769/:2846) and, in the MSI/legacy paths, main_serialize (mxge_msi asserts it at :2737) — wedging the interface and blocking every thread that later tries to take those serializers. tx->done/idx stay masked (no OOB write), so the failure mode is a permanent spin/DoS, not memory corruption on the host side.

Threat model

NIC-DMA'd counter (hostile/compromised device or device fault), identical trust boundary to DF-3680/DF-3714 (both filed Low/certain).

Verification

Hardware-gated (no Myricom NIC on the guest; module never attaches) — source-certain only, family convention → inconclusive.

Fix

fix.diff bounds the walk by ring occupancy (tx->done >= tx->req → warn + break), which kills the runaway spin; a mismatched-but-in-range counter still must be dealt with by the watchdog. git-apply clean.

DF-3718 VERDICT

Status: inconclusive (hardware-gated, family convention — cf. DF-3680 Low/certain, DF-3714 Low/certain), confidence: certain source-level.

Source proof

• mcp_idx originates from the NIC-DMA'd mcp_irq_data.send_done_count (read be32toh(stats->send_done_count) at if_mxge.c:2695/2767/2844, cast (int) and passed at :2700/:2770/:2847).
• mxge_tx_done (:2364-2415) loops while (tx->pkt_done != mcp_idx) with no relation to tx->req — the driver's own knowledge of queued descriptors. Free path per iteration: bus_dmamap_unload + m_freem on any non-NULL info[idx].m (:2381-2387).
• Forward-walk consequence A: descriptors still owned by the NIC get their maps unloaded and mbufs freed → device DMA into freed memory.
• Consequence B: pkt_done advances only on non-NULL m; after one revolution all slots are NULL → permanent interrupt-context spin under tx_serialize (and main_serialize for MSI/legacy paths, :2737) → interface and any serializer-acquiring threads wedge.

Not reproduced

Guest has no Myricom device (see env.txt); the stats block is device-written. No software-only trigger.

Fix

fix.diff: occupancy guard if (tx->done >= tx->req) break; + warning. Mitigates the infinite spin; full validation of the counter against req is the watchdog's job. fix_status=not_testable (no hardware).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.