DF-4108 — vge(4): TX short-frame pad path writes one fragment beyond vge_frag[7] when a sub-60-byte frame arrives with 7 DMA segments (maxsegs off-by-one)

File: sys/dev/netif/vge/if_vge.c (pass 2) Class: intra-ring OOB write past the descriptor's fragment array (CWE-787, bounded to the ring allocation) → next descriptor's vge_sts/vge_ctl corruption. Hardware gate: VT612x NIC (absent on the audit guest). Reachability additionally requires a pathological TX mbuf shape; see confidence note.

The defect

vge_encap allows the full fragment array: if_vge.c:1622 arg.vge_maxsegs = VGE_TX_FRAGS; (= 7, if_vgereg.h:584,606 — the array is vge_frag[VGE_TX_FRAGS]).

The map callback vge_dma_map_tx_desc (if_vge.c:690-706) fills frag[0..nseg-1] (the guard at 676 rejects only nseg > 7), then for short frames:

if (ctx->vge_m0->m_pkthdr.len < VGE_MIN_FRAMELEN) {   /* < 60 bytes */
        f = &d->vge_frag[i];        /* i == nseg == 7  -> frag[7] OOB */
        f->vge_buflen = ...;        /* offset 70-71 of the descriptor */
        f->vge_addrlo = segs[0].ds_addr;   /* offset 64-67 */
        f->vge_addrhi = ...;        /* offset 68-69 */

struct vge_tx_desc = {u32 sts; u32 ctl; frag frag[7]} = 64 bytes, so frag[7] lands at ring offset 64..71 = the next descriptor's vge_sts (bytes 0-3, fully overwritten with segs[0].ds_addr) and vge_ctl (bytes 4-7). If the next descriptor is chip-owned (in flight), its status/owner accounting is corrupted → vge_txeof may then reclaim the wrong descriptor / leak or double-free its mbuf (m_freem on a still-pending slot frees an mbuf the chip is still reading).

Reachability caveat (why Low / likely)

A frame under 60 bytes spanning exactly 7+ DMA segments is not producible by the ordinary TCP/IP output path (segment headers alone exceed 60 bytes well before 7 segments); it requires pathological mbuf chopping (e.g. via carefully constructed sendmsg/UDP with tiny buffers hitting coincident page boundaries, or a BPF write, which is privileged). The bounds-contract defect itself is certain: the pad write needs nseg+1 <= VGE_TX_FRAGS but the guard admits nseg == VGE_TX_FRAGS.

Fix

Reserve one fragment for the pad: arg.vge_maxsegs = VGE_TX_FRAGS - 1; (matching FreeBSD's later fix) — see fix.diff.

DF-4108 VERDICT

Status: untested (hardware-gated — no VT612x NIC on the audit guest; source-level defect certain, packet-shape reachability contrived → Low/likely) Impact: 8-byte OOB write past a TX descriptor's fragment array into the next descriptor (vge_sts/vge_ctl) — descriptor-accounting corruption; latent mbuf mishandling in vge_txeof if the victim descriptor is in flight.

Trace

• Array: struct vge_tx_desc { uint32_t vge_sts; uint32_t vge_ctl; struct vge_tx_frag vge_frag[VGE_TX_FRAGS]; } (if_vgereg.h:600-607, VGE_TX_FRAGS=7 at :584). Descriptor stride 64 bytes (8 + 7*8).
• Producer: vge_encap sets arg.vge_maxsegs = VGE_TX_FRAGS (if_vge.c:1622).
• Callback guard: if (nseg > ctx->vge_maxsegs) { fail } (if_vge.c:676) — admits nseg == 7.
• Frag fill loop: for (i = 0; i < nseg; i++) f = &d->vge_frag[i]; ... (690-695) — consumes all 7 slots at nseg==7.
• Pad path for frames < VGE_MIN_FRAMELEN (60): f = &d->vge_frag[i]; with i == nseg == 7 (697-706) → writes addrlo (desc+64..67 = next descriptor's vge_sts, full overwrite), addrhi (+68..69 → next vge_ctl[0:2]), buflen (+70..71 → next vge_ctl[6:8]).
• Consumer effect: vge_txeof (1425-1444) walks considx→prodidx testing txstat & VGE_TDSTS_OWN from vge_tx_list[idx].vge_sts — a corrupted sts on an in-flight descriptor can make the driver reclaim a descriptor the chip still owns (m_freem of a pending mbuf → NIC reads freed cluster) or skip one (mbuf leak / oactive stall).
• Trigger shape: pkthdr.len < 60 with exactly 7 DMA segments — not generated by ordinary stack output (needs pathological mbuf chopping; BPF writes are privileged). Hence Low severity, confidence 'likely' (defect certain, reachability contrived).

Why untested

Guest has no VIA NIC (virtio only); no TX path executes. FreeBSD's later driver history fixed this exact contract by reserving a fragment (maxsegs = VGE_TX_FRAGS - 1 style), corroborating the defect.

Fix

arg.vge_maxsegs = VGE_TX_FRAGS - 1; in vge_encap so the pad fragment always has a slot (fix.diff).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.