DF-4045 — stge_rxeof trusts the device-fed 16-bit RxDMAFrameLen (no per-buffer bound)

• File: sys/dev/netif/stge/if_stge.c (stge(4), Sundance/IC Plus IP1000A, TC9021)
• Severity: Medium · Confidence: certain · hardware-gated runtime (no stge(4) on the QEMU guest — virtio-net only)
• Family: DF-3604 (bce) / DF-3759 (alc) / DF-3933 (age) / DF-3989 (ale) / DF-4024 (re) — device-fed RX length trust

Build

cc -O2 -Wall -Wextra -o /root/tr4045 /root/tr4045.c

Run

/root/tr4045          # userspace geometry model, RC=0

Expected output

The model prints the OOB extents implied by the driver's masks/geometry:

• Case A (jumbo MTU 9004, SIOCSIFMTU-legal): a single FrameEnd descriptor claiming framelen = 9022 builds m_len = 9022 on the 2048-byte cluster from stge_newbuf → 6974-byte heap OOB read into a delivered frame (readable by any local user with a socket/BPF on stgeX).
• Case B (any MTU, incl. default): framelen < rxlen at FrameEnd → negative tail m_len → m_copydata computes unsigned count = min(m->m_len - off, len) → ~4 GB bcopy → panic/UB as soon as any consumer walks the chain (BPF attached); the first mbuf is full-sized so ether_input's m_len < ETHER_HDR_LEN guard does not stop it.

Runtime trigger precondition (NOT met on this guest): a faulty or malicious TC9021/IP1000A DMA'ing a lying RFD status quadword — see trigger.c header.

Artifacts

trigger.c, build.sh, run.sh, build.log, run.log, env.txt, fix.diff, VERDICT.md, manifest.json, verdict.json.

DF-4045 VERDICT — stge_rxeof device-fed length trust (source-certain, runtime hardware-gated)

Reproduced?

Not on hardware — the guest has no stge(4) device (env.txt: vtnet0 lo0, NO_STGE_HW, DragonFly 6.5-DEVELOPMENT). Per the established family convention (DF-3989/DF-4024) this is recorded as inconclusive at runtime, certain at source level. The geometry model (trigger.c) builds and runs on the guest with RC=0 (run.log) and prints the exact extents below.

Root cause (path:line)

stge_rxeof applies the NIC-DMA'd frame length with only a per-interface bound, never a per-buffer bound:

• sys/dev/netif/stge/if_stge.c:1606-1607 — on a FrameEnd descriptor: mp->m_len = RFD_RxDMAFrameLen(status) - sc->sc_cdata.stge_rxlen;
• if_stge.c:1608 — sc->sc_cdata.stge_rxlen += mp->m_len;
• if_stge.c:1623-1629 — the ONLY check: m->m_pkthdr.len = stge_rxlen; if (m->m_pkthdr.len > sc->sc_if_framesize) drop;
• RFD_RxDMAFrameLen(x) = x & 0xffff — raw 16-bit device-fed field, sys/dev/netif/stge/if_stgereg.h:167.
• sc_if_framesize = if_mtu + ETHER_HDR_LEN + ETHER_CRC_LEN (if_stge.c:2013), and SIOCSIFMTU accepts up to STGE_JUMBO_MTU = 9004 (if_stge.c:1261, if_stgevar.h:55-57) → framesize up to 9022.
• Every RX buffer is one MCLBYTES (2048) cluster: stge_newbuf uses m_getcl and sets m_len = MCLBYTES (if_stge.c:2326-2329); 2046 after the ETHER_ALIGN m_adj when framesize ≤ 2046 (:2335-2336).

Intermediate (non-FrameEnd) descriptors contribute their FULL buffer length (2046/2048) to stge_rxlen; the frame's total length appears only in the FrameEnd descriptor's 16-bit field.

Consequence geometry (model output, run.log)

Case A — jumbo MTU, over-long last buffer (heap OOB read): framelen = framesize = 9022 with k intermediate buffers: last m_len = 9022 − 2048·k, i.e. up to 9022 on a 2048-byte cluster → 6974 bytes read past the cluster (k=1: 4926; k=2: 2878; k=3: 830). The only driver check passes (9022 ≤ framesize). Every consumer trusting m_len/pkthdr.len — BPF tap, m_copydata pulls, protocol header reads past 2 KB — reads adjacent kernel heap into a delivered network frame: a kernel-heap info leak readable by any local user with a socket on the interface. Needs jumbo MTU (a documented, SIOCSIFMTU-legal config).

Case B — any MTU (incl. default 1500), negative tail m_len: k intermediates then FrameEnd with framelen < rxlen (e.g. k=1, framelen=100): mp->m_len = 100 − 2046 = −1946; pkthdr.len = 100 passes the check; the first mbuf is full-sized so ether_input's m_len < ETHER_HDR_LEN guard (sys/net/if_ethersubr.c) does not drop it. m_copydata (sys/kern/uipc_mbuf.c:1671,1689) computes unsigned count = min(m->m_len - off, len) on the negative tail → count ≈ 4 GB → bcopy overflow → panic / memory corruption as soon as a consumer walks the chain (BPF attached; the KASSERTs at uipc_mbuf.c:1680+ are compiled out of GENERIC).

Threat model

Device-fed bug: requires a faulty or malicious TC9021/IP1002A (compromised NIC firmware, malicious PCIe/Thunderbolt NIC, or a second kernel bug that corrupts the coherent RX ring). Inbound-only: read primitive (Case A) / DoS-grade UB (Case B); no write primitive. Same threat framing as the rest of the DF-3604 family.

Fix validation

fix.diff bounds the FrameEnd m_len to [0, MCLBYTES] and drops the frame using the driver's own error-drop idiom (free chain + reset + continue, mirroring the existing iqdrops path at if_stge.c:1595-1602). git apply --check passes against the read-only tree; runtime validation would require stge(4) hardware (not present on the guest) — fix_status: not_testable.

Negative space checked this pass on the same surface

• txeof producer/consumer arithmetic sound (if_stge.c:1455-1495): tx_cnt == len(busyq) invariant, HIWAT 248 < RING_CNT 256 so tx_prod can never lap tx_cons, init marks all TFDs done with an empty busyq (:2280) and the tx_cnt <= 0 guard precedes every control read.
• stge_encap freeq non-empty guaranteed by the HIWAT gate (:1186); error path frees the mbuf before any queue mutation (:1114-1118).
• dma_alloc failure paths pair with dma_free (:849-1036).
• Residual (not filed): stge_tx_error's register-drain loop (:1356-1381) is bounded only by hardware clearing TS_TxComplete — device-gated DoS, weaker than the DF-3761 unbounded-walk shape (no counter bound applies to a status register).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.