DF-4387 — Device-controlled sc->port_id indexes rxf.port[] unchecked in the BE2/BE3 stats copy (OOB read → world-readable sysctls)

• sys/dev/netif/oce/oce_mbox.c:493 — sc->port_id = fwcmd->params.rsp.port_id; (raw firmware uint32_t, never range-checked)
• sys/dev/netif/oce/oce_sysctl.c:1146,1151 — copy_stats_to_sc_be2: port_stats = &nic_mbx->params.rsp.stats.rxf.port[port]; where port[2] (oce_hw.h:2943)
• sys/dev/netif/oce/oce_sysctl.c:1211,1216 — copy_stats_to_sc_be3: same, port[4] (oce_hw.h:3004)

~66 dwords are then copied from port_stats into sc->oce_stats_info, whose fields are published world-readable under hw.oceN.stats.rx.* / hw.oceN.stats.tx.*. port_id ≥ 2 (BE2) / ≥ 4 (BE3) reads past the port array; a large enough port_id reads past the entire mbx_get_nic_stats{,_v0} DMA allocation (oce_stats_init sizes stats_mem to exactly the struct) into adjacent kernel heap — and those bytes land in world-readable sysctls.

Build / run

./run.sh — hardware gate + replica printing the read offsets for port_id 0..5 against the real array/struct geometry.

Expected

port_id=4: read at rxf+1056 [PAST port[] ARRAY] [PAST mbx_get_nic_stats DMA BUFFER]-style lines. Kernel confirmation needs an Emulex adapter whose QUERY_FW_CONFIG returns port_id ≥ array bound.

DF-4387 VERDICT

Trace

1. oce_mbox_get_fw_config() stores the raw firmware dword: sc->port_id = fwcmd->params.rsp.port_id (sys/dev/netif/oce/oce_mbox.c:493) — no mask, no range check anywhere in the driver (other uses pass it back to the device at oce_mbox.c:1063,1879).
2. oce_refresh_nic_stats() → copy_stats_to_sc_be2() / copy_stats_to_sc_be3() index with it: - sys/dev/netif/oce/oce_sysctl.c:1151 — rxf.port[port], oce_rxf_stats_v0.port[2] (oce_hw.h:2943) - sys/dev/netif/oce/oce_sysctl.c:1216 — rxf.port[port], oce_rxf_stats_v1.port[4] (oce_hw.h:3004) Both then copy ~26 port fields plus rxf_stats/pmem fields into sc->oce_stats_info.u0.be.
3. Exposure: every copied field is a CTLFLAG_RD sysctl node created at attach (oce_add_stats_sysctls_be3, oce_sysctl.c:538-752) — readable by any user (sysctl hw.oceN.stats.rx.err.crc_errs etc.).
4. Allocation: oce_stats_init() (oce_sysctl.c:1268-1284) sizes the DMA block to exactly sizeof(struct mbx_get_nic_stats_v0) / sizeof(struct mbx_get_nic_stats), so the OOB read runs off the end of the oce_dma_alloc mapping into adjacent kernel heap once port_id outruns the struct (replica arithmetic in run.log: port_id 4 already clears both the port[] array and the rxf-sized buffer model).

Threat model: device-controlled index (malicious/compromised NIC or DMA), unprivileged reader harvests the leaked dwords. Missing-validation class, same family as the DF-1576 device-trust pattern.

Verification (Phase V)

Kernel path hardware-gated (no 19a2: device, no hw.oce tree — run.log). Demonstrated: exact-geometry replica (trigger.c, guest run in run.log) showing which port_id values cross which boundary. fix.diff clamps port_id to NELEM(rxf.port) at both copy functions; git apply --check OK; patched file syntax-validated on the guest kernel toolchain (0 errors).

Bottom line

Certain code-wise, device-gated exploit-wise: Low. Two-line defense-in-depth clamp; worth fixing alongside any broader "validate fw_config" hardening.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.