DF-4326 — sf(4) RX completion endidx OOB write past the whole descriptor block

File: sys/dev/netif/sf/if_sf.c:940 (sf_rxeof)

cur_rx->sf_endidx is an 11-bit buffer-descriptor index DMA-written by the AIC-6915. The driver does desc = &sf_rx_dlist_big[sf_endidx] with no bounds check against SF_RX_DLIST_CNT (256). Values 256..2047 dereference up to 1792 entries past the array; sf_newbuf() (if_sf.c:892-894) then WRITES there: an mbuf pointer (8 bytes), a 30-bit DMA address + valid bit. endidx=2047 lands 12,272 bytes past the END of the entire 40,960-byte contigmalloc'd struct sf_list_data — i.e. straight into adjacent kernel heap, with semi-controlled content.

Distinct from DF-1526 (that finding covers the length sf_len and the RXDQ buffer-length misprogramming; this is the descriptor index).

Build / Run

Same module as DF-4325. sysctl kern.sfrh.run=3 Expected (run.log): canary bytes past the block end clobbered with exactly the planted mbuf pointer/DMA address; "OOB WRITE PAST sf_list_data PROVEN".

DF-4326 — verdict: REPRODUCED (harness on live kernel; hardware-gated path)

Root cause (path:line)

• sys/dev/netif/sf/if_sf.c:940 — desc = &sc->sf_ldata->sf_rx_dlist_big[cur_rx->sf_endidx]; sf_endidx is u_int32_t sf_endidx:11 (if_sfreg.h:728-739) = 0..2047; sf_rx_dlist_big has SF_RX_DLIST_CNT = 256 entries of 16 bytes at offset 20480 of struct sf_list_data (total 40960 bytes, if_sfreg.h:988-1003).
• sys/dev/netif/sf/if_sf.c:947/953 — sf_newbuf(sc, desc, m) stores desc->sf_mbuf (kernel pointer), desc->sf_addrlo (30-bit DMA address), desc->sf_valid = 1 at the OOB address (stores at if_sf.c:892-894).

What was proven on the guest (kern.sfrh.run=3, run.log)

• Layout verified live: sf_list_data = 40960 bytes; rx_dlist_big spans +20480..+24576.
• endidx=2047 -> desc at blk+53232 = 12,272 bytes past the end of the whole struct sf_list_data allocation.
• The exact sf_newbuf stores landed there: canary at +53232..53235 shows the bitfield word (0x2badb002|valid), +53240..53243 shows the planted mbuf pointer 0xabcd11112222 — "12/16384 canary bytes clobbered -> OOB WRITE PAST sf_list_data PROVEN".
• gcc -Warray-bounds statically proves the index expression too (build.log).

Impact

Hardware-gated (NIC DMA) OOB WRITE of {pointer, DMA address, flag} at NIC-chosen offsets up to ~28KB past the ring / ~12KB past the whole DMA block into adjacent kernel heap. On real hardware this is a kernel heap-corruption primitive (content semi-controlled: real mbuf pointer + vtophys-derived address); realistic ceiling: crash to heap corruption. Not reachable to uid=0 on this guest (no AIC-6915 NIC present) — chain not attempted past the demonstrated primitive.

Fix

Bounds-check cur_rx->sf_endidx before the dereference (fix.diff).

Fix validation

fix_status=not_testable: fix targets sf_rxeof(), which executes only on AIC-6915 hardware absent from the guest; harness replicates driver code in a module and cannot observe sys/ changes.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.