DF-3720 — Firmware-returned SRAM offsets used as kernel write pointers with no validation (hostile-device family); plus int16_t ring-mask truncation

Vulnerability

sys/dev/netif/mxge/if_mxge.c repeatedly turns a device-returned offset (mxge_send_cmd response cmd.data0) into a raw pointer into the mapped SRAM BAR (sc->sram, size sc->sram_size :4290) and then writes through it, with no range check anywhere:

A hostile/compromised NIC (or one returning garbage after a fault) supplies an offset ≥ sram_size and the kernel performs MMIO writes past the pmap_mapdev window — kernel-VA memory corruption with partially attacker-chosen data (RSS table bytes are host-derived; intr_coal value is a root-settable int; descriptors contain DMA addresses).

Related same-family sloppiness in the same flow: mxge_rx_ring_t.mask and cl_size are int16_t (if_mxge_var.h:65-66) while the entry counts derive from the NIC-returned GET_RX_RING_SIZE/GET_SEND_RING_SIZE (mxge_alloc_slices :3960-3961, mxge_alloc_rings :3194-3196): a ring size ≥ 512 KiB (entries ≥ 32768) wraps the mask negative (:3007-3009) and idx = rx->cnt & rx->mask sign-extends garbage.

Contrast: mxge_adopt_running_firmware does bounds-check its device-supplied header offset against sc->sram_size (:867) — the check pattern exists in the file; the loci above simply never got it.

Threat model

Hostile/faulting PCIe device (same premise as DF-3716/3718 and the igb/bge/em device-trust findings). Not reachable by network input alone.

Verification

Hardware-gated; source-certain; inconclusive per family convention.

Fix

fix.diff adds mxge_sram_range_valid() and applies it at all four loci (intr-coal/ack/deassert offsets, both send-offset branches, both rx-offset commands, RSS table and key), failing open with ENXIO/EIO. git-apply clean. (int16_t mask widening is a larger mechanical change; flagged in the diff comment in the finding text only.)

DF-3720 VERDICT

Status: inconclusive (hardware-gated), confidence: certain source-level.

Source proof

• Every locus in the README table: cmd.data0 (device response) -> pointer into sc->sram -> unconditional write. No sram_size comparison anywhere in mxge_reset (:1207-1215), mxge_slice_open (:3255-3283), or the RSS table/key writes (:3362-3364, :3379-3384).
• The check pattern demonstrably exists in-file: mxge_adopt_running_firmware validates its device offset against sc->sram_size at :867.
• int16_t mask/cl_size (if_mxge_var.h:65-66) fed by device ring sizes (:3960, :3194-3196) -> entries >= 32768 wraps negative (:3007-3009).
• Sinks are reachable on every interface up/reset (attach does reset+open), and intr_coal_delay_ptr is writable live by root via sysctl (:1339).

Not reproduced

No Myricom device on the guest (env.txt); offsets come from the device.

Fix

fix.diff: mxge_sram_range_valid() applied at all four loci (git apply --check clean). fix_status=not_testable (no hardware to build against).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.