DF-5270
Last-TRB TD Size clear masks only 4 of the 5 TDSZ field bits (15 instead of 31) β controller mispredicts remaining packets on large transfers
Summary
'clear TD SIZE to zero' masks ~TDSZ_SET(15) but the field is 5 bits (31): when npkt had bit 4 set the last TRB reports 16 packets remaining - missed service opportunities, babble/short-packet misbehavior, completion timeouts on real silicon (QEMU model ignores TD Size so cannot manifest in guest). Upstream fixed by FreeBSD 4e792e431a92 (EuroBSDcon, real hardware). One-constant fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5270 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1019 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5270
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace + upstream fix-commit cross-reference
Verified recommended fix
see finding markdown
Verdict
untested (Low; streams mode off-by-default / QEMU xhci ignores TD Size - manifests only on real silicon per upstream reports)
No comments yet.