DF-3723 — ixgbe_checksum_ptr_x550 caller-buffer path: bounds checks ignore the ptr base offset (+ two off-by-ones) → OOB read past caller's u16 buffer[]

File: sys/dev/netif/ix/ixgbe_x550.c (lines 3338–3397, 3407–3433) Severity: Low (latent — no in-tree caller passes a non-NULL buffer) Confidence: certain (source-proven + on-guest bound-math demo)

Build / Run (bound-math demo)

The guest has no X550 NIC, so the HAL cannot run on hardware. The demo replicates the exact shipped guards and loop and shows a valid-looking call reading past the end of the caller's buffer; it also runs the fixed guards (the exact code in fix.diff) and shows them rejecting the same call.

# on the audit host:
ssh -F dfbsd-qemu/config dfbsd 'cat > /tmp/chksum_bounds_demo.c' < chksum_bounds_demo.c
dfbsd-qemu/vm.sh run_root 'cc -O2 -o /tmp/chksum_bounds_demo /tmp/chksum_bounds_demo.c && /tmp/chksum_bounds_demo'

Expected (observed, see run.log):

SHIPPED: OOB READ — first out-of-bounds word index = 100 (buffer holds 0..99); reads run to buffer[90+50]=buffer[140]
FIXED:   rejected (ERR_PARAM) — OOB prevented
OFF-BY-ONE (buffer_size == ptr == 90): SHIPPED ACCEPTS and reads buffer[90] (reads length at buffer[90] — one word past end)
OFF-BY-ONE: FIXED rejects

Fix compile-validation (see fix_build.log)

fix.diff was applied inside the guest's /usr/src/sys/dev/netif/ix/ copy (repo sys/ is read-only and was never touched) and the if_ix module rebuilt with the kernel warning set including -Werror:

cc ... -Werror ... -c /usr/src/sys/dev/netif/ix/ixgbe_x550.c
cc -Wl,--build-id=sha1 ... -r -o if_ix.ko ... ixgbe_x550.o     # make_rc=0

The patch was then reverted in the guest (md5 restored to baseline).

Artifacts

• chksum_bounds_demo.c / build.log / run.log — on-guest bound-math demo
• fix.diff — 3-hunk guard fix, git-apply-able against sys/dev/netif/ix/ixgbe_x550.c
• fix_build.log — full module build with the fix applied (clean, -Werror)
• env.txt — guest uname + pciconf (no X550 present) + compiler version
• VERDICT.md, manifest.json, verdict.json

DF-3723 — VERDICT

Status: inconclusive at runtime (no X550 hardware on the guest), source-certain, bound-math violation demonstrated on the guest, fix compiles clean.

Root cause (path:line into sys/dev/netif/ix/ixgbe_x550.c)

ixgbe_calc_checksum_X550(hw, buffer, buffer_size) is the exported shared-code API for checksumming a caller-held NVM image. In the buffer != NULL path its helper ixgbe_checksum_ptr_x550():

1. ixgbe_x550.c:3358 — if (buffer_size < ptr) return IXGBE_ERR_PARAM; then :3360 local_buffer = &buffer[ptr]; and :3368 length = local_buffer[0];. When buffer_size == ptr, buffer[ptr] is exactly one word past the end — the check must be <= (off-by-one).
2. ixgbe_x550.c:3376 — if (buffer && ((u32)start + (u32)length > buffer_size)) validates start + length against the buffer base, but the reads at :3394 are local_buffer[i] == buffer[ptr + i] for i ∈ [start, start+length). The ptr base offset is missing from the bound, so the walk can extend ptr words past the end. Concrete passing case: buffer_size=100, ptr=90, buffer[90]=50 → guards pass (91 ≤ 100), loop reads buffer[91..140] → 41 words OOB (demo output in run.log).
3. ixgbe_x550.c:3430 — if (buffer_size < IXGBE_EEPROM_LAST_WORD) but the loop at :3439 is for (i = 0; i <= IXGBE_EEPROM_LAST_WORD; i++) — with buffer_size == 0x41 exactly, local_buffer[0x41] is one word OOB (second off-by-one).

DF-3670 family (NVM-walk bounds), X550 variant: the defect is confined to the caller-buffer path. The live path taken at attach time (if_ix.c:615 → validate_eeprom_checksum → calc_eeprom_checksum → ixgbe_calc_checksum_X550(hw, NULL, 0)) is safe: the NVM-walk there is bounded by pointer >= hw->eeprom.word_size (:3454-3456) and (ptr + length) >= hw->eeprom.word_size (:3371-3373), and the 256-word stack chunk buffer (:3342) is correctly refilled (:3380-3393) — verified by trace, no OOB.

Why only Low

• No in-tree caller passes a non-NULL buffer. The only caller is ixgbe_calc_eeprom_checksum_X550() (ixgbe_x550.c:3488-3491) which passes NULL, 0; ixgbe_api.c exposes no ixgbe_calc_checksum(hw, buf, size) wrapper in this tree, and if_ix.c never touches eeprom.ops.calc_checksum with a buffer. Dead code in the kernel as built (compiled in, never executed) — same posture as DF-1862 (latent).
• Upstream-identical defect: verified 2026-09-15 against Linux master (drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c, ixgbe_checksum_ptr_x550, same buffer_size < ptr and start + length > buffer_size) and FreeBSD head (sys/dev/ixgbe/ixgbe_x550.c:3325,3343). Not a DragonFly regression.
• If a future caller (e.g. an NVM-tool ioctl or ported FreeBSD ixgbe_ndd/eeprom-dump sysctl) passes a user-sized buffer, this becomes a kernel OOB read whose 16-bit checksum return is a (weak) info-leak oracle over adjacent kernel memory.

Verification performed

Recommended fix

fix.diff in this pack (3 hunks): - :3358 buffer_size < ptr → buffer_size <= ptr - :3376 add (u32)ptr + to the bound - :3430 buffer_size < IXGBE_EEPROM_LAST_WORD → < IXGBE_EEPROM_LAST_WORD + 1

Worth carrying upstream (Linux/FREEBSD share the bug).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.