am7990_start_locked lacks the 'break' after detecting a LANCE-owned TMD (dead-code twin of DF-4745): on a ring desync the driver dequeues an mbuf and overwrites the chip-owned descriptor and TX buffer
Summary
Same missing-upstream-break defect as DF-4745, verified identical by direct read; falls through to dequeue+lance_put overwriting a chip-owned TMD. am7990_config has zero in-tree callers (if_lnc_pci wires only am79900_config) - dead code on every current platform; filed for parity. One-line break fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4775 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1003 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
n/a on this tree (dead code); if revived: TX-ring desync -> driver overwrites chip-owned descriptor/buffer -> mangled frames + BUFF-error watchdog loop (interface hang)
Evidence (decisive lines)
findings/poc/DF-4775/ (this verdict)
Verdict
Source-certain dead-code twin of DF-4745 (verified identical structure by direct read): am7990_start_locked falls through to ifq_dequeue+lance_put after detecting a chip-owned TMD (missing upstream break, am7990.c:503-508). am7990_config has ZERO in-tree callers (if_lnc_pci.c:431 wires only am79900_config) - compiled into if_lnc.ko but unreachable on every current DFly platform; would need a future bus front-end. No LANCE hardware in QEMU. One-line break fix (fixes both twins in one sweep).
No comments yet.