DF-4079 — oce_rx: CQE pkt_size vs num_fragments×frag_size desync builds an

inconsistent mbuf chain (m_pkthdr.len > Σ m_len) handed to the network stack

File: sys/dev/netif/oce/oce_if.c (pass 2) Class: memory-safety contract violation → stack offset-walker panic (m_copydata KASSERT) / TCP sequence desync VERIFIED: reproduced (baseline + panic) on the DFly QEMU guest via the production-handler KLD dispatch rig; fix validated on a rebuilt kernel.

How it was verified without OneConnect hardware

The guest kernel is built with device oce (X86_64_GENERIC), so the driver's production code — including the static oce_rx() — lives in the RUNNING kernel image. The KLD rig (df4079_oce_poc.c):

• references the kernel's own oce_rq_handler(), oce_alloc_rx_bufs(), oce_create_ring_buffer(), oce_destroy_ring_buffer() and oce_free_posted_rxbuf() as extern symbols (kernel-loader bound — nothing recompiled);
• fabricates the post-attach softc exactly as production leaves it (BE3 flags, frag_size 2048, verbatim oce_rq_init DMA replay, real busdma rings from the kernel's own ring allocator, MMIO BAR stand-in pages);
• posts real RX clusters via the REAL oce_alloc_rx_bufs();
• crafts the CQE bitfields the way firmware DMA-writes them: pkt_size=16383, num_fragments=1 and pkt_size=16383, num_fragments=7;
• dispatches the REAL oce_rq_handler(rq) (static oce_rx runs inside);
• captures the delivered chain in an if_input shim and prints claimed (m_pkthdr.len) vs actual (Σ m_len).

Results (stock kernel #0 Thu Jul 2 06:02:54 UTC 2026)

• case 1 (pkt_size=16383, nf=1): chain 2048 bytes, claims 16383 → 14335 phantom bytes
• case 2 (pkt_size=16383, nf=7): chain 7×2048=14336 bytes, claims 16383 → 2047 phantom bytes (the finding's headline gap)
• panic mode: the real stack offset-walker m_copydata(m, off=2056, 8) — the exact consumer cited (sys/kern/uipc_mbuf.c:1679, kernel built with INVARIANTS) — panics: panic: m_copydata: offset > size of mbuf chain with backtrace m_copydata() ← df4079_input() ← oce_rx.isra.10() ← oce_rq_handler() — production oce_rx built the chain, production m_copydata died on it.

Fix validation (fix.diff, fix_build.log, fix_run.log)

fix.diff adds the residual-length check to oce_rx: if len != 0 after the fragment loop, the chain is freed and dropped. Applied to the guest's /usr/src (identical to the audit tree), kernel rebuilt (make -j6 nativekernel KERNCONF=X86_64_GENERIC) and installed, booted into #1: Thu Oct 15 13:06:11 UTC 2026. The SAME rig re-run against the patched kernel's own oce_rq_handler (address re-resolved at module load): both crafted CQEs dropped — chains delivered to if_input: 0; invariant violations: 0; rx_pkts=0 → FIX CONFIRMED; panic mode on the patched kernel SURVIVES (no chain → no m_copydata dispatch → no panic).

Reproduce

vm.sh run_root 'sh /root/df4079/build.sh'    # build the KLD
vm.sh run_root 'sh /root/df4079/run.sh baseline'   # survives, prints violations
vm.sh reset with-src                          # fresh boot for the panic run
vm.sh run_root 'sh /root/df4079/run.sh panic'      # kernel panic

Threat model unchanged from the finding: pkt_size/num_fragments are firmware/DMA-controlled; the driver must not trust the completion.

DF-4079 VERDICT — oce_rx pkt_size/fragment-count desync

Status: REPRODUCED (baseline invariant-violation + m_copydata panic; fix validated on rebuilt kernel)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 (stock) and #1 (patched), x86_64. Method: production-handler KLD dispatch rig (the DF-4106/DF-4266/if_et evidence class) — no OneConnect hardware needed because device oce is compiled into the guest's X86_64_GENERIC kernel.

What ran (all production code, kernel-loader bound)

1. Rig externs: oce_rq_handler, oce_alloc_rx_bufs, oce_create_ring_buffer, oce_destroy_ring_buffer, oce_free_posted_rxbuf — resolved against the running kernel's symbol table at kldload (verified: dispatched handler address 0xffffffff805c9e50 = nm(1) T oce_rq_handler).
2. Fabricated post-attach state: BE3 softc (flags, ring sizes, rq_frag_size=2048 per oce_if.c:236), verbatim oce_rq_init DMA replay (oce_queue.c:429-455: same tag params, 1024 dmamaps, real ring from the kernel's own oce_create_ring_buffer), RX CQ ring (256×16B), real ifnet with an if_input inspection shim, MMIO BAR stand-in pages (register offsets all < 0x140, oce_hw.h:64-88).
3. Posted 16 real clusters via REAL oce_alloc_rx_bufs (m_getcl + bus_dmamap_load_mbuf_segment + RQEs + doorbell to the stand-in page).
4. Crafted CQEs as firmware would DMA them (DW_SWAP is a no-op on LE, oce_if.h:1114): case 1 pkt_size=16383, num_fragments=1, valid=1; case 2 pkt_size=16383, num_fragments=7, valid=1.
5. Dispatched REAL oce_rq_handler(rq) → static oce_rx (confirmed in the panic backtrace as oce_rx.isra.10) → sc->ifp->if_input(...).

Observed (stock kernel, run.log / panic.txt)

• case 1: delivered chain [m_len=2048] with m_pkthdr.len=16383 → 14335 phantom bytes.
• case 2: delivered chain of 7×2048=14336 bytes with m_pkthdr.len=16383 → 2047 phantom bytes (max representable chain data 7×2048=14336 < 16383=max 14-bit pkt_size: the trust-boundary gap).
• rq->rx_stats.rx_bytes += 32766 — stats count phantom bytes (oce_if.c:1381).
• Deterministic: baseline run twice, identical results.
• panic mode (panic.txt): panic: m_copydata: offset > size of mbuf chain — the exact cited KASSERT (sys/kern/uipc_mbuf.c:1679-1680, INVARIANTS kernel), backtrace m_copydata() ← df4079_input() ← oce_rx.isra.10() ← oce_rq_handler(). The rig's m_copydata call models any offset-walking stack consumer (forwarding/fragmentation/ICMP-error paths) that trusts pkthdr.len.

Impact ceiling on this guest

Kernel panic (DoS) demonstrated. Escalation beyond DoS would require the frame bytes (also firmware-controlled) to steer a stack consumer into an OOB copy — the primitive is the 2047-byte phantom region the stack will read past the chain's real end; on this guest the walk hits the KASSERT first. Threat model: buggy/malicious NIC firmware or device DMA; not remotely reachable without the NIC writing the CQE.

Fix validation (fix.diff / fix_build.log / fix_run.log)

fix.diff = residual-length check in oce_rx (drop when len != 0 after the fragment loop). Applied to guest /usr/src (md5-identical to audit tree before patch), make -j6 nativekernel KERNCONF=X86_64_GENERIC + installkernel (full 41592-line log: fix_build.log), rebooted into #1: Thu Oct 15 13:06:11 UTC 2026.

• baseline on patched kernel: both crafted CQEs dropped — chains delivered to if_input: 0; invariant violations: 0; rx_pkts=0; rx_bytes=0 → FIX CONFIRMED (handler address moved to 0xffffffff805c9e80 = the rebuilt kernel's own oce_rq_handler).
• panic mode on patched kernel: SURVIVED (no chain ever reaches if_input, so the m_copydata dispatch never happens).

Distinct from DF-1371 (pckts[] array over-walk): DF-4079 needs no RQ-array inconsistency — the RQ walk here is perfectly legal; only the chain length contract is violated.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.