DF-5401
mos_intr_callback() counts every interrupt as an output error and copies 4 bytes regardless of actlen into a never-used local; mos_bulk_write_callback() double-counts opackets
Summary
oerrors incremented before the state switch (every successful interrupt counts as an error); 4-byte copy with no actlen check into a dead local (in-page over-read only, no disclosure); opackets double-counted per transmitted packet. netstat -i permanently skewed, masking real error bursts. Move-the-counter + gate-the-copy + drop-the-duplicate fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5401 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 894 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5401
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (Info; correctness/observability only)
No comments yet.