DF-3781 VERDICT — REPRODUCED (mechanism, protocol-replica) — impact: panic (OOB MMIO write; cross-device corruption variant also demonstrated)

Bottom line

In the update_rxhead path of vmxnet3_rxq_eof() (if_vmx.c:2315-2327) the guest computes a BAR0 MMIO register offset from the raw 10-bit host field rxcd->qid after only subtracting nrxqueues. The derived index is never range-checked, so offsets up to 0xA00 + 1022*8 = 0x29F0 are written — past the 4KB vmxnet3 BAR0 (defined RXH2 space ends at 0xA78). The guest kernel executes an out-of-BAR MMIO write with a host-chosen offset and a host-influenced value, on every RX completion while the host keeps update_rxhead set (host-writable shared DMA).

Proof on the guest

1. Probe (sysctl hw.vmxrep.run=37811): pages at BAR0+0x1000 and BAR0+0x2000 are unmapped KVA in the tested layout → any qid mapping there faults.
2. Write (hw.vmxrep.run=3781, hostile qid=705 → offset 0x2000): Fatal trap 12, supervisor write, fault virtual address 0xffffffff82605000 (= BAR0 page + 0x2000), Stopped at vmxrep_sysctl: movl $0x1,(%rbx) — the exact vmxnet3_write_bar0(sc, r, idx) store (if_vmx.c:2326/3867-3871). panic.txt.
3. Cross-device variant: in an earlier run (different mapdev placement) the target at +0x29F0 resolved to a mapped foreign MMIO page — the write would have corrupted another device's registers. Both outcomes observed on this guest across two boots; the host chooses qid and therefore the outcome.

Threat model / severity

Malicious (compromised ESXi backend / nested-hypervisor) or buggy host. The fault variant is a deterministic guest panic (DoS); the foreign-MMIO variant is an OOB write gadget into adjacent device MMIO (write value 0..ndesc-1, host-chosen offset within 0xA78..0x2FF0), whose ceiling depends on the platform's MMIO layout. Medium within the paravirtual trust boundary.

Fix validation

Kernel-build validation impossible (no vmxnet3 device on the KVM guest). Fix LOGIC validated in the replica (test 902, fixrun.log): with the range check if (qid >= nrxqueues) suppress, the identical hostile qid=705 produces "MMIO write suppressed, guest alive". fix.diff authors the check.

Kernel refs

sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2315-2327 (the block), if_vmx.c:2320 (idx from rxd_idx), if_vmx.c:3867-3871 (write_bar0), if_vmxreg.h:63-64 (RXH1/RXH2 register file), if_vmxreg.h:148 (qid:10), if_vmxreg.h:298-300 (update_rxhead in host-writable rxq_shared).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.