RedBear-OS/local/docs/NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md

# Red Bear OS — Networking & Drivers CODE-FOCUSED Systematic Assessment (2026-07-27)

> **MASTER CODE AUDIT** for the network stack + drivers + daemons + utils surface.
> This document is the single consolidated CODE-focused assessment. NOT docs.
> Find file:line references, severity, and fix recommendations for every finding.

## 0. Document Status & Scope

### 0.1 Purpose

This is the canonical **CODE-focused** systematic assessment of every networking, driver, daemon, and util surface in Red Bear OS that touches the network or hardware stack. It synthesizes findings from **6 parallel deep code audits** executed 2026-07-27.

**Read this when:**
- Triaging a code defect in networking, a driver, or a system daemon
- Planning which code to fix next
- Understanding actual runtime risks (memory safety, race conditions, FFI soundness)
- Prioritizing test-coverage gaps

**This is NOT a documentation audit** — the docs assessment lives in `local/docs/NETWORKING-AND-DRIVERS-SYSTEMATIC-ASSESSMENT-2026-07-27.md`.

### 0.2 In-Scope Code Surfaces (6 audit surfaces)

| # | Surface | Scope |
|---|--------|-------|
| 1 | **Wired network stack** | netstack/src/*.rs (42 files), dhcpd, relibc socket, libredox, 5 ethernet drivers |
| 2 | **Wireless + Bluetooth** | redbear-iwlwifi (3,368 LOC C+Rust), linux-kpi, wifictl, btusb, btctl |
| 3 | **USB + PCI + ACPI + IOMMU** | xhcid (27 files), ehci/uhci/ohci, usb-core, pcid, acpid, iommu, driver-manager |
| 4 | **relibc + libredox + syscall** | socket.rs (1,236 LOC), PalSocket trait (99 unsafe), libredox (49 unsafe), kernel scheme |
| 5 | **Daemons** | netctl/wifictl/btctl/dnsd/sessiond/greeter/driver-manager/dbus + 30 others |
| 6 | **Test + Build config** | test quality, recipe.toml anomalies, Cargo.toml, init services, scheme protocols |

### 0.3 Audit Provenance (6 Parallel Deep Code Audits)

| Audit | Surface | Output |
|-------|---------|--------|
| A1 | Wired network stack | 34 findings (3 CRITICAL, 8 HIGH, 17 MEDIUM) |
| A2 | Wireless + Bluetooth | 33 findings (3 CRITICAL, 10 HIGH, 14 MEDIUM) |
| A3 | USB + PCI + ACPI + IOMMU | 22 findings (3 CRITICAL, 9 HIGH, 10 MEDIUM) |
| A4 | relibc + libredox + syscall | 35 findings (2 CRITICAL, 11 HIGH, 14 MEDIUM) |
| A5 | Daemons | 45+ findings (7 CRITICAL, 13 HIGH, 18 MEDIUM) |
| A6 | Test + Build config | 34 findings (6 CRITICAL, 7 HIGH, 11 MEDIUM) |
| **Total** | **All** | **~203 findings** |

### 0.4 Severity Rubric

- **CRITICAL** — UB, data leak, panic in production, security bypass, missing critical path
- **HIGH** — Potential crash, silent failure, missing functionality, FFI unsoundness
- **MEDIUM** — Correctness gap, reliability issue, missing safety doc, missing test
- **LOW** — Cosmetic, naming, observability

---

## 1. Executive Summary

### 1.1 Top-Line Findings

1. **CRITICAL: BufferPool exposes stale packet data via unsafe `set_len`** (`netstack/src/buffer_pool.rs:84-86`). Recycled buffers carry previous packet's data — information disclosure vector.

2. **CRITICAL: relibc `recvmsg()` has unbounded `msg_iovlen`** (`socket.rs:888`). Malicious C programs can create arbitrary-length slices from raw pointers → heap corruption.

3. **CRITICAL: libredox `demux()` panics on edge-case errno** (`lib.rs:43`). `.expect("2^BITS - res < 4096")` can panic — called from every syscall wrapper.

4. **CRITICAL: ECDSA firmware blob out-of-bounds panic** (`redbear-btusb/src/btintel.rs:178-187`). Missing length check for ECDSA firmware path causes slice panic.

5. **CRITICAL: Use-after-free in `rb_iwlwifi_bridge_tx_submit`** (`linux_port.c:2687-2715`). Static `hw` pointer with no synchronization — Rust scheme TX path can submit frames to a freed `ieee80211_hw`.

6. **CRITICAL: xHCI IRQ reactor state re-entrancy race** (`xhcid/src/xhci/irq_reactor.rs:429-467`). `state.finish()` (wakes future) called BEFORE clearing event TRB → wrong-state match risk.

7. **CRITICAL: xHCI `phys_addr_to_index` bounds off-by-one** (`xhcid/src/xhci/ring.rs:72-94`). `>` should be `>=` → OOB array access and panic.

8. **CRITICAL: DNS compression pointer infinite loop** (`redbear-dnsd/src/transport.rs:236-290`). No jump-count limit → scheme daemon DoS.

9. **CRITICAL: DHCP child process leaked as zombie** (`redbear-netctl/src/main.rs:248-258`). `let _child = ...` drops handle without wait.

10. **CRITICAL: firmware-loader uses `.expect()` everywhere** (`firmware-loader/src/main.rs:48-100`). Any error crashes the daemon.

11. **CRITICAL: btctl TOCTOU race** (`redbear-btctl/src/main.rs:140-174`). `.exists()` then `fs::write()` — file could vanish.

12. **CRITICAL: WifiCtlScheme exposes Wi-Fi key world-readable via fstat** (`redbear-wifictl/src/scheme.rs:475-491`). `Key` handle reports `0o644`.

13. **CRITICAL: Zero test coverage on most critical modules** — TCP scheme, Router, EthernetLink, BufferPool, DHCP, all NIC drivers, iwlwifi ISR/RX/TLV parsers, IOMMU page table walks.

14. ~~**CRITICAL: Two config files reference non-existent `redbear-minimal.toml`**~~ — **RESOLVED 2026-07-27**: `redbear-wifi-experimental.toml:9` and `redbear-bluetooth-experimental.toml:10` now both read `include = ["redbear-mini.toml"]`. See 3D-DESKTOP-COMPREHENSIVE-PLAN.md § config-table for the post-fix state.

15. ~~**CRITICAL: `redbear-passwd/recipe.toml` has no `[source]` section**~~ — **RESOLVED 2026-07-27** (commit a9e1c34e27): `[source] path = "source"` added.

### 1.2 Critical Path Hierarchy

```
P0 — Memory Safety (4-5 days, 1 dev)
├── BufferPool zero-fill (CRITICAL F001)
├── relibc recvmsg() msg_iovlen guard (CRITICAL F1.4)
├── libredox demux() unwrap_or (CRITICAL 3.1)
├── xHCI phys_addr_to_index >= fix (CRITICAL F1.6)
├── xHCI acknowledge() re-entrancy fix (CRITICAL F1.1)
├── redbear-btintel ECDSA length check (CRITICAL F22/F23)
└── dnsd compression loop limit (CRITICAL F4)

P1 — Error Handling & FFI Safety (1-2 weeks)
├── 99 unsafe blocks in relibc socket.rs: add # Safety docs
├── 49 unsafe blocks in libredox: add # Safety docs
├── 52 unsafe blocks in ethernet drivers: add # Safety docs + bounds checks
├── WifiCtlScheme Key handle mode 0o200 (CRITICAL F7)
├── firmware-loader expect() → match/Result (CRITICAL F5)
├── netctl DHCP child wait() (CRITICAL F3)
└── btctl TOCTOU fix (CRITICAL F6)

P2 — Test Coverage & Build Configuration (2-3 weeks)
├── Add unit tests for TCP scheme, Router, EthernetLink, BufferPool
├── Add tests for STP, SLAAC, DHCP, NIC drivers
├── ~~Fix redbear-wifi-experimental.toml / redbear-bluetooth-experimental.toml include path~~ ✅ RESOLVED 2026-07-27
├── ~~Add [source] section to redbear-passwd/recipe.toml~~ ✅ RESOLVED 2026-07-27
├── Fix recipe.toml version mismatches (0.1.0 → 0.3.1)
└── Fix dhcpd Cargo.toml version 0.0.0
```

### 1.3 Headline Metrics

| Metric | Count |
|--------|-------|
| Total findings | **~203** |
| CRITICAL findings | **24** |
| HIGH findings | **58** |
| MEDIUM findings | **84** |
| LOW findings | **37** |
| Unsafe blocks with `# Safety` docs | **0** (out of ~330) |
| Test coverage on critical modules (TCP scheme, Router, etc.) | **0** |
| Files audited | **200+** |
| Lines of code reviewed | **~30,000+** |

---

## 2. Methodology

**Parallel deep code analysis** across 6 distinct code surfaces. Each agent performed ACTUAL file reading (not file enumeration), producing findings with file:line + code snippet + severity + recommended fix.

**Methods used by each agent:**
- **A1 Wired network:** Read all 42 netstack source files + dhcpd + 5 ethernet drivers
- **A2 Wireless/BT:** Read redbear-iwlwifi (3,368 LOC) + linux-kpi C headers + Rust impl + wifictl + btusb + btctl
- **A3 USB/PCI/ACPI:** Read 27 xhci files + ehci/uhci/ohci + usb-core + pcid + acpid + iommu
- **A4 relibc/libredox:** Read full socket.rs (1,236 LOC) + PalSocket trait + lib.rs SocketCall + kernel scheme dispatch
- **A5 Daemons:** Read netctl (1,086 LOC) + wifictl backend (1,440 LOC) + btusb hci (1,900 LOC) + btctl hci_backend (1,479 LOC) + dnsd transport (485 LOC) + 30+ other daemon files
- **A6 Test/Build:** Read all test files + recipe.toml files + Cargo.toml files + init services + scheme protocols

**Confidence:** All findings verified against current source files at audit time (2026-07-27).

---

## 3. Critical & High-Severity Defects by Surface

### 3.1 Wired Network Stack (A1)

#### F001 — CRITICAL: BufferPool exposes stale packet data
**File:** `local/sources/base/netstack/src/buffer_pool.rs:84-86`
```rust
Some(mut v) => {
    let capacity = v.capacity();
    unsafe {
        v.set_len(capacity);
    }
    v
}
```
**Defect:** Previously-returned buffers recycled without zeroing. Bytes between length and capacity contain **previous packet data**. Consumer receives Buffer whose contents are previous packet's data. If consumer fails to overwrite every byte before transmitting, stale data leaks. **Persistent information disclosure.**
**Fix:** `v.fill(0u8); unsafe { v.set_len(0); }` — accept the memset cost.

#### F002 — HIGH: OwnedFd dups arbitrary raw fds
**File:** `local/sources/base/netstack/src/worker_pool.rs:61-65`
```rust
pub fn from_raw_fd(raw: usize) -> std::io::Result<Self> {
    let dup_fd = unsafe { libc::dup(raw as i32) };
    if dup_fd < 0 { return Err(...); }
    let f = unsafe { File::from_raw_fd(dup_fd) };
```
**Defect:** Caller passing garbage `usize` triggers `libc::dup()` on whatever that number maps to. Could acquire unauthorized file handles.
**Fix:** Require caller to supply `OwnedFd` not raw `usize`.

#### F003 — HIGH: NIC fd double ownership via from_raw_fd
**File:** `local/sources/base/netstack/src/scheme/mod.rs:181-182, 193`
**Defect:** `Fd.into_raw() as RawFd` then `File::from_raw_fd` — i32 truncation possible, ownership chain confused.
**Fix:** Use `Fd` throughout, avoid `from_raw_fd` in netstack.

#### F005 — HIGH: e1000d MMIO without bounds check
**File:** `local/sources/base/drivers/net/e1000d/src/device.rs:248-254`
```rust
pub unsafe fn read_reg(&self, register: u32) -> u32 {
    ptr::read_volatile((self.base + register as usize) as *mut u32)
}
```
**Defect:** No bounds check on `register`. Out-of-range reads arbitrary MMIO. Only ixgbed has guards.
**Fix:** `debug_assert!(register <= self.size - 4)` mirroring ixgbed.

#### R002 — HIGH: Dead `is_orig` variable in conntrack::track()
**File:** `local/sources/base/netstack/src/filter/conntrack.rs:285-296`
**Defect:** `is_orig` can only ever be `true` (if branch returns immediately). Reply-direction state transitions never reached.
**Fix:** Restructure logic, remove dead variable.

#### P001 — MEDIUM (firewalling): IPv6 extension headers bypass port filters
**File:** `local/sources/base/netstack/src/router/mod.rs:528-545`
**Defect:** IPv6 packets with extension headers produce `src_port: None, dst_port: None` → filter rules with `--dport` silently fail. **Firewall bypass.**
**Fix:** Reject IPv6 packets with extension headers, or use smoltcp's `next_header()` to chase them.

#### Test Coverage Gaps (TCP scheme, Router, EthernetLink, DHCP, all NIC drivers)
- TCP scheme (`scheme/tcp.rs`): **0 tests** — highest-risk module
- Router (`router/mod.rs`): **0 tests** — most complex module
- EthernetLink (`link/ethernet.rs`): **0 tests** — ARP/NDP/SLAAC untested
- DHCP client: **1 test** — only MacAddr parsing
- All 4 NIC drivers: **0 tests**
- `filter/stp.rs` and `filter/slaac.rs`: **0 tests**

### 3.2 Wireless + Bluetooth (A2)

#### Finding 23 — CRITICAL: ECDSA firmware blob out-of-bounds
**File:** `local/recipes/drivers/redbear-btusb/source/src/btintel.rs:178-187`
```rust
CssKeyType::Ecdsa => {
    if fw_data.len() < 644 {
        warn!("btintel: ECDSA firmware too short ({} bytes)", fw_data.len());
        return commands;
    }
    commands.extend(secure_send_commands(FRAGMENT_TYPE_CSS, &fw_data[644..644 + 128]));
    commands.extend(secure_send_commands(FRAGMENT_TYPE_PKEY, &fw_data[644 + 128..644 + 224]));
    commands.extend(secure_send_commands(FRAGMENT_TYPE_SIGNATURE, &fw_data[644 + 224..644 + 320]));
    let payload = &fw_data[644 + 320..];
```
**Defect:** Slicing beyond 644+320=964 without length check. Panics on firmware between 644 and 964 bytes.
**Fix:** `if fw_data.len() < 964` for ECDSA path.

#### Finding 7 — CRITICAL: Static hw pointer racing in bridge_tx_submit
**File:** `local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c:2687-2715`
```c
static struct ieee80211_hw *rb_iwlwifi_bridge_hw;
int rb_iwlwifi_bridge_tx_submit(const uint8_t *data, size_t len) {
    struct ieee80211_hw *hw = rb_iwlwifi_bridge_hw;
```
**Defect:** No sync; shutdown frees `hw` but Rust scheme still references it.
**Fix:** Atomic pointer + set NULL before freeing.

#### Finding 4 — HIGH: Key material out-of-bounds read
**File:** `local/recipes/drivers/redbear-iwlwifi/source/src/mld/dispatch.rs:270-277`
```rust
let key_slice = if key_len > 0 && !key_data.is_null() {
    unsafe { std::slice::from_raw_parts(key_data, key_len as usize) }
```
**Defect:** No validation that `key_len` matches actual allocation.
**Fix:** Cap `key_len` to known maximum (32 bytes for WPA2 CCMP).

#### Finding 5 — HIGH: SkBuff layout mismatch between Rust callback.rs and C linux-kpi
**File:** `local/recipes/drivers/redbear-iwlwifi/source/src/bridge/callback.rs:34-44`
**Defect:** Rust redefines `SkBuff` with different field order than C header. UB if bridge_rx_callback dereferences `data`/`len`.
**Fix:** Use `linux_kpi::rust_impl::net::SkBuff` instead.

#### Finding 11 — HIGH: request_irq thread leak on error path
**File:** `local/recipes/drivers/linux-kpi/source/src/rust_impl/irq.rs:60-82`
**Defect:** Spawned thread not joined on error path → resource leak.
**Fix:** Always join thread before returning.

#### Finding 16 — HIGH: IntelBackend spawns child process with no timeout
**File:** `local/recipes/system/redbear-wifictl/source/src/backend.rs:285-336`
**Defect:** `Command::output()` blocks indefinitely. Hung driver blocks entire scheme:wifictl.
**Fix:** Add timeout wrapper.

#### Finding 17 — HIGH: scheme:wifictl state snapshot race
**File:** `local/recipes/system/redbear-wifictl/source/src/scheme.rs:392-421`
**Defect:** `self.state(&iface)?.clone()` then `backend.connect(&iface, &snapshot)` — state not locked between.
**Fix:** Wrap entire connect flow in critical section.

#### Finding 20 — HIGH: HciCommand::to_bytes saturates param_len
**File:** `local/recipes/drivers/redbear-btusb/source/src/hci.rs:129-138`
**Defect:** `param_len = u8::try_from(...).unwrap_or(0xFF)` silently produces 0xFF header for oversized commands. Protocol violation.
**Fix:** Return Err instead of silently exceeding HCI limit.

#### Finding 28-30 — CRITICAL: iwlwifi ISR/RX/TLV parsers have ZERO tests
**Files:** `linux_port.c:1740-1760` (ISR), `linux_port.c:1497-1615` (RX handler), `linux_mvm.c:99-212` (TLV parser)
**Defect:** Most complex hardware-state code has no test coverage. Any bug here = device hang or interrupt storm.

### 3.3 USB + PCI + ACPI + IOMMU (A3)

#### Finding 1.1 — CRITICAL: IRQ reactor state re-entrancy race
**File:** `local/sources/base/drivers/usb/xhcid/src/xhci/irq_reactor.rs:429-467`
```rust
self.acknowledge(event_trb.clone()) {
    // state.finish() may immediately re-enter reactor
}
event_trb.reserved(false);  // ← TOO LATE
```
**Defect:** `state.finish()` calls `waker.wake()` → future re-enters reactor → new state added to `self.states` BEFORE old event TRB is cleared. Could match wrong state.
**Fix:** Detach state and finish AFTER clearing event TRB.

#### Finding 1.6 — CRITICAL: phys_addr_to_index `>` should be `>=`
**File:** `local/sources/base/drivers/usb/xhcid/src/xhci/ring.rs:72-94`
```rust
if index > self.trbs.len() {  // BUG
    return None;
}
Some(index)
```
**Defect:** `index == len` is one-past-end. Used as `&self.trbs[index]` → OOB panic.
**Fix:** `if index >= self.trbs.len()`.

#### Finding 1.7 — HIGH: acknowledge_failed_transfer_trbs empty-states panic
**File:** `local/sources/base/drivers/usb/xhcid/src/xhci/irq_reactor.rs:548-565`
**Defect:** First access `self.states[0]` panics if empty.
**Fix:** Add `if self.states.is_empty() { return; }`.

#### Finding 1.3 — HIGH: DMA pool has unsound lifetime gap
**File:** `local/sources/base/drivers/usb/xhcid/src/xhci/mod.rs:1133-1141`
**Defect:** Pool reuses buffers across transfers. Two concurrent DMA ops could share buffer.
**Fix:** Track InUse/Free state, never reuse until completion event.

#### Finding 3.1 — CRITICAL: usbhubd hub power-on missing inrush delay
**File:** `local/sources/base/drivers/usb/usbhubd/src/main.rs:201-400`
**Defect:** USB 2.0 §11.12 requires `bPwrOn2PwrGood * 2 ms` between port power-on. Missing delay trips over-current protection or causes enumeration failure.

#### Finding 4.1 — HIGH: pcid MSI clear without save
**File:** `recipes/drivers/pcid/src/main.rs:153-233`
**Defect:** `enable_function` clears MSI/MSI-X on every enable. Hardcoded fallback IRQ 9 may conflict on real hardware.
**Fix:** Query ACPI PRT for actual legacy IRQ routing.

#### Finding 4.3 — HIGH: pcid scans bus 0x80 unconditionally
**File:** `recipes/drivers/pcid/src/main.rs:287-289`
**Defect:** Bus 0x80 scanned on systems where it doesn't exist → SERR# or machine check.
**Fix:** Only scan bus 0x80 if ACPI MCFG/host bridge indicates existence.

#### Finding 5.1 — HIGH: acpid AML interpreter has no timeout/recursion limit
**File:** `recipes/drivers/acpid/src/acpi.rs:74`
**Defect:** Vendor AML can infinite-loop via While opcodes, read/write arbitrary physmem.
**Fix:** Add instruction counter or timeout.

#### Finding 6.1 — HIGH: IOMMU command buffer no write fence
**File:** `local/recipes/system/iommu/source/src/command_buffer.rs:145-415`
**Defect:** No `sfence` between command buffer write and doorbell ring → reordering → IOMMU reads stale data.
**Fix:** Add `atomic::fence(Ordering::Release)` before doorbell.

#### Finding 6.3 — MEDIUM: IOMMU IVRS discovery has no checksum validation
**File:** `local/recipes/system/iommu/source/src/main.rs:120-148`
**Defect:** Bypasses acpid checksum → corrupted IVRS misconfigures IOMMU.

#### Finding 10.1 — CRITICAL: xHCI has ZERO integration tests
**Defect:** No tests for TRB ring ops, event handling, 36-error-code recovery matrix, DMA pool reuse. QEMU-only validation.

#### Finding 10.2 — HIGH: IOMMU has ZERO tests
**Defect:** Page table walks, IOVA allocation, command buffer encoding entirely untested.

### 3.4 relibc + libredox + syscall (A4)

#### Finding 1.4 — CRITICAL: recvmsg() unbounded msg_iovlen
**File:** `local/sources/relibc/src/platform/redox/socket.rs:888`
```rust
unsafe { slice::from_raw_parts(mhdr.msg_iov, mhdr.msg_iovlen) }
```
**Defect:** Malicious C program with `msg_iovlen = 1_000_000` and `msg_iov` pointing to single struct reads far beyond allocation.
**Fix:** `if mhdr.msg_iovlen > MAX_IOV_LEN { return Err(Errno(EMSGSIZE)); }` (Linux `IOV_MAX` = 1024).

#### Finding 3.1 — CRITICAL: demux() panic on overflow
**File:** `local/sources/libredox/src/lib.rs:43`
```rust
errno: res.wrapping_neg().try_into().expect("2^BITS - res < 4096"),
```
**Defect:** `.expect()` panics if errno doesn't fit in `u16`. Called from every syscall wrapper.
**Fix:** `errno: res.wrapping_neg().try_into().unwrap_or(u16::MAX)`.

#### Finding 1.1 — HIGH: All 14 PalSocket trait methods are `unsafe` with zero docs
**File:** `local/sources/relibc/src/platform/pal/socket.rs:11-98`
**Defect:** C FFI passes raw pointers through these methods; no `# Safety` sections.

#### Finding 1.2 — HIGH: bind_or_connect unchecked sockaddr cast
**File:** `local/sources/relibc/src/platform/redox/socket.rs:35-69`
**Defect:** `(*address).sa_family` deref without null check; cast unchecked.
**Fix:** Add `# Safety` doc + null check.

#### Finding 1.3 — HIGH: inner_af_inet 4 .expect() panics on network data
**File:** `local/sources/relibc/src/platform/redox/socket.rs:162-169`
**Defect:** Malicious scheme daemon → panic in C library. No catch_unwind.
**Fix:** Replace `.expect()` with proper Result.

#### Finding 1.5 — HIGH: SCM_RIGHTS cmsg traversal overflow
**File:** `local/sources/relibc/src/platform/redox/socket.rs:278-341`
**Defect:** Unsigned arithmetic in `CMSG_NXTHDR` overflows → walks arbitrary memory.

#### Finding 1.6 — HIGH: sendto()/setsockopt() unwrap on as_c_fd()
**File:** `local/sources/relibc/src/platform/redox/socket.rs:1055,1090`
**Defect:** fd > i32::MAX → panic.
**Fix:** Propagate error via `?`.

#### Finding 1.7 — MEDIUM: MSG_NOSIGNAL silently stripped
**File:** `local/sources/relibc/src/platform/redox/socket.rs:1029`
**Defect:** SIGPIPE not suppressed; fails POSIX conformance. Test at `tests/sys_socket/shutdown.c:70` exercises this.

#### Finding 1.8 — HIGH: TCP SendMsg TODO may be stale
**File:** `local/sources/relibc/src/platform/redox/socket.rs:1028`
**Defect:** Comment says TCP lacks SendMsg handling, but netstack `scheme/socket.rs:519-533` does handle it. Stale TODO.

#### Finding 2.2 — MEDIUM: CMSG_NXTHDR integer overflow
**File:** `local/sources/relibc/src/header/sys_socket/mod.rs:129-138`
**Defect:** `cmsg as usize + CMSG_ALIGN((*cmsg).cmsg_len)` can wrap on crafted `cmsg_len`.

#### Finding 3.2 — MEDIUM: FdGuard::Drop swallows close errors
**File:** `local/sources/libredox/src/lib.rs:502-504`

#### Finding 9.1 — HIGH: relibc Cargo.toml `missing_safety_doc = "allow"`
**File:** `local/sources/relibc/Cargo.toml:35`
**Defect:** Suppresses documentation requirement for all 99 unsafe blocks.

#### Finding 9.2 — HIGH: libredox has no [lints] section
**File:** `local/sources/libredox/Cargo.toml`
**Defect:** 49 unsafe blocks un-linted.

#### Finding 6.1 — MEDIUM: getsockopt/setsockopt fall through to todo_skip
**File:** `local/sources/relibc/src/platform/redox/socket.rs:824-833,1116-1126`
**Defect:** `setsockopt` returns `Ok(())` for unknown options. Violates POSIX.

### 3.5 Daemons (A5)

#### Finding 1 — CRITICAL: dnsd unsafe mutable static DNS_TID
**File:** `local/recipes/system/redbear-dnsd/source/src/transport.rs:42-58`
```rust
static mut DNS_TID: u16 = 0x42;
fn next_tid() -> u16 {
    unsafe {
        let mut x = DNS_TID;
        // xorshift update...
        DNS_TID = x;
        x
    }
}
```
**Defect:** Data race across threads. Duplicate transaction IDs.
**Fix:** Use `AtomicU16` with `fetch_update`.

#### Finding 2 — CRITICAL: dnsd loopback listener no shared cache
**File:** `local/recipes/system/redbear-dnsd/source/src/main.rs:83-125`
**Defect:** Every query on 127.0.0.1:53 hits network — no caching. Comment admits the gap.
**Fix:** Share `DnsCache` + `NegativeCache` via Arc<Mutex<>>.

#### Finding 3 — CRITICAL: netctl DHCP child zombie
**File:** `local/recipes/system/redbear-netctl/source/src/main.rs:248-258`
**Defect:** `let _child = ...` drops handle without wait. Zombies accumulate.
**Fix:** Call `child.wait()` or spawn dhcpd as daemon.

#### Finding 4 — CRITICAL: dnsd compression pointer infinite loop
**File:** `local/recipes/system/redbear-dnsd/source/src/transport.rs:236-290`
**Defect:** No jump-count limit. Malicious DNS response DoSes scheme daemon.

#### Finding 5 — CRITICAL: firmware-loader .expect() crashes daemon
**File:** `local/recipes/system/firmware-loader/source/src/main.rs:48-100`
**Defect:** Every error path uses `.expect()` — panics take down service.

#### Finding 6 — CRITICAL: btctl TOCTOU on .exists() then fs::write()
**File:** `local/recipes/system/redbear-btctl/source/src/main.rs:140-174`
**Defect:** Classic TOCTOU. Remove `.exists()` check.

#### Finding 7 — CRITICAL: WifiCtlScheme Key handle world-readable via fstat
**File:** `local/recipes/system/redbear-wifictl/source/src/scheme.rs:475-491`
**Defect:** `HandleKind::Key(_)` reports `MODE_FILE | 0o644`. PSK exposed.
**Fix:** Change to `MODE_FILE | 0o200` (write-only).

#### Finding 8 — HIGH: wifictl TestBackend panics on multiple methods
**File:** `local/recipes/system/redbear-wifictl/source/src/scheme.rs:593-620`
**Defect:** `todo!()` macros on connect/disconnect/retry → panic in test mode.

#### Finding 9 — HIGH: netctl parse_profile empty SSID accepted
**File:** `local/recipes/system/redbear-netctl/source/src/main.rs:609-691`
**Defect:** `SSID=""` passes `.ok_or_else()` (Some("") is truthy). Invalid profile silently applied.

#### Finding 10 — HIGH: firmware-loader creates new SchemeState per request
**File:** `local/recipes/system/firmware-loader/source/src/main.rs:91-99`
**Defect:** Per-request state breaks multi-call protocols (open→read→close).

#### Finding 11 — HIGH: btctl scheme read refreshes bonds on every status read
**File:** `local/recipes/system/redbear-btctl/source/src/scheme.rs:335-417`
**Defect:** N+1 filesystem reads from each of 4 handle reads.

#### Finding 13 — HIGH: btctl bond_store parse_record silently defaults created_at_epoch to 0
**File:** `local/recipes/system/redbear-btctl/source/src/bond_store.rs:181-207`
**Defect:** Corrupted timestamp silently accepted as epoch zero.

#### Finding 14 — HIGH: authd verify_encoded().unwrap_or(false) swallows Argon2 errors
**File:** `local/recipes/system/redbear-authd/source/src/main.rs:190-193`
**Defect:** Argon2 internal errors silently treated as "password mismatch".

#### Finding 17 — MEDIUM: wifictl bypasses redox-driver-sys PCI parsing
**File:** `local/recipes/system/redbear-wifictl/source/src/backend.rs:740-813`
**Defect:** Direct `fs::read_dir` on `/scheme/pci` instead of using imported `redox_driver_sys::pci`.

#### Finding 18 — MEDIUM: wifictl backend transport_probe swallows driver errors
**File:** `local/recipes/system/redbear-wifictl/source/src/backend.rs:630-646`
**Defect:** `.ok()` silently converts all driver errors to None.

#### Finding 22 — MEDIUM: nmap port range DoS vector
**File:** `local/recipes/system/redbear-nmap/source/src/main.rs:182-213`
**Defect:** `"1-65535"` produces 65535 sequential TCP connects, hours of scanning.

#### Finding 27 — MEDIUM: dnsd drops subscription FD
**File:** `local/recipes/system/redbear-dnsd/source/src/main.rs:192-193`
**Defect:** `_netcfg_fd = ...;` immediately dropped; never detects nameserver changes.

### 3.6 Test + Build Config (A6)

#### Finding 18 — CRITICAL: ~~redbear-wifi-experimental.toml references non-existent redbear-minimal.toml~~ **RESOLVED 2026-07-27**
**File:** `config/redbear-wifi-experimental.toml:9`
```toml
include = ["redbear-mini.toml"]
```
**Original defect:** Correct file is `redbear-mini.toml`. Build would have failed.
**Fix applied:** Renamed reference to `redbear-mini.toml`. Config now builds.

#### Finding 18b — ~~CRITICAL: redbear-bluetooth-experimental.toml same broken include~~ **RESOLVED 2026-07-27**
**File:** `config/redbear-bluetooth-experimental.toml:10`
Same fix: `include = ["redbear-mini.toml", "redbear-bluetooth-services.toml"]`.

#### Finding 19 — ~~CRITICAL: redbear-passwd recipe.toml missing [source]~~ **RESOLVED 2026-07-27**
**File:** `local/recipes/system/redbear-passwd/recipe.toml`
**Original defect:** No `path = "source"`. Cookbook couldn't find source.
**Fix applied:** `[source] path = "source"` added (commit a9e1c34e27).

#### Finding 32 — CRITICAL: redbear-device-services.toml has 14× firmware fallback duplication
**File:** `config/redbear-device-services.toml` (~1137 lines)
**Defect:** Same 4 firmware fallback TOML blocks repeated ~14 times.
**Fix:** Define fallbacks once, refactor.

#### Finding 9 — CRITICAL: netstack/filter/stp.rs and slaac.rs have ZERO tests
**Files:** `local/sources/base/netstack/src/filter/{stp,slaac}.rs`

#### Finding 10 — CRITICAL: dhcpd has only 1 test
**File:** `local/sources/base/dhcpd/src/main.rs` (422 lines, 1 test)

#### Finding 20 — HIGH: 30+ recipe.toml files have version 0.1.0 but Cargo.toml says 0.3.1
**Defect:** Per `local/AGENTS.md`, all in-house crates must use branch version. On `0.3.1`, all recipe.toml versions must be `0.3.1`.
**Fix:** Run `./local/scripts/sync-versions.sh`.

#### Finding 11/27 — HIGH: dhcpd Cargo.toml has version 0.0.0 + empty dependencies
**File:** `local/sources/base/dhcpd/Cargo.toml`

#### Finding 13 — HIGH: openssh recipe.toml has 3 TODOs + IPv4-only sed workaround
**File:** `recipes/net/openssh/recipe.toml:5-6,40,49`
**Defect:** `sed -i "s/#AddressFamily any/AddressFamily inet/g"` — stub-level workaround.

#### Finding 28 — MEDIUM: iwlwifi build.rs uses fragile relative paths
**File:** `local/recipes/drivers/redbear-iwlwifi/source/build.rs:4`
```rust
let linux_kpi_headers = PathBuf::from("../../linux-kpi/source/src/c_headers");
```
**Fix:** Use `CARGO_MANIFEST_DIR`.

#### Finding 26 — MEDIUM: syscall Cargo.toml missing [patch.crates-io] for libredox
**File:** `local/sources/syscall/Cargo.toml`

#### Finding 12 — MEDIUM: redox-driver-sys smoke_test gated on redox feature
**File:** `local/recipes/drivers/redox-driver-sys/source/Cargo.toml:28-30`
**Defect:** Cannot run on host CI.

#### Finding 22 — MEDIUM: redbear-meta stale iwlwifi exclusion comment

#### Finding 29 — MEDIUM: iwlwifi build.rs no `rerun-if-changed`
**Defect:** Changing `linux_port.c` doesn't trigger rebuild via build.rs.

---

## 4. Completeness Assessment

### 4.1 Implemented & Functional (per §4 of previous docs-assessment)
IPv4+IPv6 TCP/UDP/ICMP · TCP_CUBIC · Socket options · Raw IP · Loopback · ARP/NDP/SLAAC · Routing · Netfilter · Conntrack · NAT · TUN/VLAN/VXLAN/GRE/IPIP/Bridge/Bond/STP · DHCPv4 (one-shot) · DNS + mDNS · POSIX sockets (~80-85%) · pcid (MSI/MSI-X) · acpid · IOMMU · driver-manager · USB xHCI (QEMU-proven) · USB BOT/HID · e1000/rtl8139/virtio-net (QEMU) · iwlwifi (host-tested) · wifictl (host-tested) · btusb (151 tests) · btctl (56 tests, BLE battery) · Daemons: devfsd, driver-manager, dbus, sessiond, greeter, authd · Utils: netctl, netctl-console, netstat, traceroute, nmap, mtr, openssh, curl, wget.

### 4.2 Critical Missing Code Paths (CODE-level)
- **Wi-Fi IP datapath bridge** (802.11→Ethernet into netstack's `DeviceList`) — single most critical unimplemented feature
- **DHCP lease renewal/rebind** — one-shot only
- **redbear-dnsd config wiring** — built but excluded from all `redbear-*.toml` config targets
- **TPMS SendMsg in relibc** — TCP variant may have bug (stale TODO)
- **usbctl source** — recipe skeleton only

### 4.3 Test Coverage Gaps (CRITICAL)

| Module | Tests | Status |
|--------|-------|--------|
| TCP scheme (`scheme/tcp.rs`) | **0** | CRITICAL GAP |
| Router (`router/mod.rs`) | **0** | CRITICAL GAP |
| EthernetLink (`link/ethernet.rs`) | **0** | CRITICAL GAP |
| BufferPool (`buffer_pool.rs`) | **0** | CRITICAL GAP |
| DHCP (`dhcpd/src/main.rs`) | 1 (MacAddr only) | CRITICAL GAP |
| NIC drivers (5) | **0** | CRITICAL GAP |
| iwlwifi ISR (`linux_port.c`) | **0** | CRITICAL GAP |
| iwlwifi RX handler | **0** | CRITICAL GAP |
| iwlwifi TLV parser | **0** | CRITICAL GAP |
| IOMMU (`iommu/source/`) | **0** | CRITICAL GAP |
| netstack filter STP | **0** | CRITICAL GAP |
| netstack filter SLAAC | **0** | CRITICAL GAP |
| conntrack `track()` R002 race | **0** | CRITICAL GAP |
| LinuxKPI wireless layer | partial | COVERED (107 inline tests) |
| relibc socket.rs | 1 C test | CRITICAL GAP |
| libredox | **0** | CRITICAL GAP |

**Coverage totals:** Only ~328 host unit tests exist across the entire networking+driver+daemon surface — overwhelmingly concentrated in linux-kpi, btusb, btctl, wifictl. The most complex and security-critical modules (TCP scheme, Router, NIC drivers) have ZERO tests.

---

## 5. Bad Practices

### 5.1 Memory Safety Documentation Gap (THE WORST)

| File | Unsafe blocks | Safety docs |
|------|---------------|-------------|
| `relibc/src/platform/redox/socket.rs` | **99** | **0** |
| `libredox/src/lib.rs` | **49** | **0** |
| `local/sources/base/drivers/net/{5 drivers}/src/*.rs` | **52** | **0** |
| `local/recipes/drivers/redox-driver-sys/source/src/` | **~80** | **0** |
| `local/sources/base/netstack/src/` | 7 | **0** |
| `redbear-netctl/source/src/main.rs` | 4 | **0** |
| `redbear-wifictl/source/src/{main,backend,scheme}.rs` | 10 | **0** |
| `redbear-netctl-console/source/src/{main,app,ui,backend}.rs` | 14 | **0** |
| `redbear-btctl/source/src/*.rs` | 2 | **0** |
| `redbear-dnsd/source/src/{main,scheme,transport}.rs` | 5 | **0** |
| `redbear-traceroute/source/src/*.rs` | 8 | **0** |
| **Total** | **~330** | **0** |

### 5.2 Concurrency Antipatterns
- **`static mut DNS_TID`** in dnsd — data race across threads (CRITICAL F1)
- **TOCTOU** in btctl `.exists()` then `fs::write()` (CRITICAL F6)
- **xHCI IRQ re-entrancy** (CRITICAL F1.1)
- **conntrack dead `is_orig`** (HIGH R002)
- **scheme:wifictl state snapshot** (HIGH F17)
- **redbear-sessiond Arc<Mutex<Option<>>>** race (HIGH F15)
- **authd unbounded Vec<Instant>** memory growth (MEDIUM F25)

### 5.3 Error Handling Antipatterns
- **99 unsafe blocks in relibc** with no error propagation path
- **49 unsafe blocks in libredox** with `.expect()` panic sites
- **`Result<T, String>`** throughout dhcpd instead of typed errors
- **`bool` return from IRQ handlers** — can't signal MMIO faults
- **`LinkDevice::send/recv` returns `()`/`Option`** — can't propagate errors
- **65 `let _ = ...`** silent error swallows across the audited surfaces

### 5.4 Protocol Correctness Gaps
- **IPv6 extension headers bypass port filters** (firewall bypass)
- **TCP_MAXSEG/IP_TTL/SO_REUSEADDR collision** on option #2
- **DNS compression pointer infinite loop**
- **ECDSA firmware blob slice panic**

### 5.5 Build Configuration Antipatterns
- **30+ recipe.toml version mismatches** (0.1.0 vs Cargo.toml 0.3.1)
- **dhcpd Cargo.toml version 0.0.0** + empty deps
- **`missing_safety_doc = "allow"`** in relibc/Cargo.toml:35
- **No `[lints]`** in libredox
- **Build.rs uses fragile relative paths** that break on directory moves

---

## 6. Cross-Cutting Concerns

### 6.1 Memory Safety (Critical)

The single most pervasive issue is the complete absence of `# Safety` documentation across ~330 unsafe blocks. This is documented per-surface in §5.1.

Critical individual memory safety bugs (highest priority):
1. **BufferPool stale data exposure** (F001) — immediate security issue
2. **relibc recvmsg unbounded msg_iovlen** (F1.4) — heap corruption vector
3. **libredox demux panic** (F3.1) — panics from every syscall wrapper
4. **xHCI phys_addr_to_index OOB** (F1.6) — single-char fix
5. **ECDSA firmware blob slice** (F22) — runtime panic

### 6.2 Concurrency Model

Three patterns in concurrent use:
1. **Polling** (netstack — smoltcp `poll()`)
2. **Tokio** (wifictl via zbus feature)
3. **Synchronous blocking** (all other daemons)

Mixing tokio with blocking I/O in same address space could cause starvation.

### 6.3 Error Handling Pattern Fragmentation (5 concurrent)

1. Custom `Error` enum (netstack)
2. `anyhow::Context` + `anyhow::Result` (netstack mixed)
3. `SyscallError` directly (netstack scheme handlers)
4. `Errno` (relibc socket.rs)
5. `libredox::Error` (libredox, all daemons)
6. `String` error messages (dhcpd, daemons)

**Action:** Create shared `redbear-net-error` crate.

### 6.4 FFI Soundness Issues

| File | Issue |
|------|-------|
| `relibc/src/platform/redox/socket.rs` | 99 unsafe blocks with no docs, msg_iovlen OOB, raw c_void ptr, fd-id narrowing |
| `libredox/src/lib.rs` | 49 unsafe blocks, demux panic, Fd::Drop error swallow |
| `local/sources/base/drivers/net/{5 drivers}/src/*.rs` | 52 unsafe blocks, MMIO without bounds, panic on bad BAR |
| `linux-kpi` | C FFI boundary issues, `request_irq` thread leak, detached `request_firmware_nowait` |
| `redbear-iwlwifi/source/src/linux_port.c` | ISR casts dev_id unvalidated, SkBuff layout mismatch |
| `redbear-iwlwifi/source/src/mld/dispatch.rs` | key_slice out-of-bounds |
| `redbear-btusb/src/btintel.rs` | ECDSA firmware OOB |

### 6.5 Test Coverage Strategy

- **Host unit tests:** Only on linux-kpi (107), btusb (164 inline), btctl (56 inline), wifictl (2 integration), iwlwifi (3 integration). Total ~328.
- **QEMU tests:** in `local/scripts/` per USB-VALIDATION-RUNBOOK.md
- **Bare-metal:** operator-reported via HARDWARE-VALIDATION-MATRIX.md
- **CI gate:** None currently — recommendation: add gate in P2-7

---

## 7. Gaps (Feature Gaps)

See also §7 of previous docs-assessment.

**Code-level gaps discovered in this audit:**

- **BufferPool: zero-fill on recycle** (security)
- **relibc: IOV_MAX guard** (security)
- **libredox: panic-free demux** (stability)
- **xHCI: OOB bounds check + re-entrancy fix** (stability)
- **dnsd: compression pointer loop limit** (DoS prevention)
- **netctl: DHCP child wait()** (zombie prevention)
- **firmware-loader: proper Result handling** (stability)
- **WifiCtlScheme: Key handle 0o200** (privacy)
- **redbear-dnsd: Arc<Mutex<>> for shared cache** (correctness)
- **openssh recipe: implement IPv6 properly** (no IPv4-only sed)
- ~~**redbear-passwd recipe: add [source]**~~ ✅ RESOLVED 2026-07-27
- ~~**Config files: fix redbear-minimal.toml → redbear-mini.toml**~~ ✅ RESOLVED 2026-07-27

---

## 8. Blockers (Hardware/Validation)

### 8.1 Hardware (per §8 of docs-assessment)
- No Intel Wi-Fi NIC in any bench (W4 blocked)
- No Bluetooth hardware (B7 blocked)
- No USB-C Ethernet dongle (LG Gram bare-metal networking blocked)
- Threadripper NIC inventory uncollected
- No physical EHCI/UHCI/OHCI controller
- No physical 10GbE NIC

### 8.2 Code-side Blockers (NEW from this audit)
- **DHCP test coverage gap**: cannot validate renewal/rebind logic without tests
- **xHCI integration tests**: 36-error-code recovery matrix unverified
- **IOMMU page table encoding**: untested → cannot validate AMD-Vi setup
- **relibc FFI documentation**: cannot safely evolve socket layer without Safety docs
- **Build configuration drift**: 30+ recipe.toml version mismatches block proper incremental builds

---

## 9. Fix/Improvement Roadmap (Code-Focused)

### 9.1 P0 — Correctness & Safety (Immediate, 1-2 weeks, 1 dev)

| ID | Action | Surface | Severity | Effort |
|----|--------|---------|----------|--------|
| P0-1 | Zero-fill BufferPool on recycle | netstack | CRITICAL | 30 min |
| P0-2 | Add msg_iovlen guard to relibc recvmsg | relibc | CRITICAL | 1 hour |
| P0-3 | Replace demux().expect() with unwrap_or | libredox | CRITICAL | 5 min |
| P0-4 | xHCI phys_addr_to_index `>=` fix | xhcid | CRITICAL | 5 min |
| P0-5 | xHCI acknowledge() re-entrancy fix | xhcid | CRITICAL | 2-4 hours |
| P0-6 | ECDSA firmware length check | btintel | CRITICAL | 30 min |
| P0-7 | DNS compression pointer loop limit | dnsd | CRITICAL | 30 min |
| P0-8 | DHCP child wait() | netctl | CRITICAL | 30 min |
| P0-9 | firmware-loader expect→match | firmware-loader | CRITICAL | 2 hours |
| P0-10 | btctl remove .exists() pre-check | btctl | CRITICAL | 15 min |
| P0-11 | WifiCtlScheme Key handle 0o200 | wifictl | CRITICAL | 5 min |
| P0-12 | ~~Fix redbear-wifi-experimental.toml include~~ ✅ RESOLVED 2026-07-27 | config | — | — |
| P0-13 | ~~Fix redbear-bluetooth-experimental.toml include~~ ✅ RESOLVED 2026-07-27 | config | — | — |
| P0-14 | ~~Add [source] to redbear-passwd recipe.toml~~ ✅ RESOLVED 2026-07-27 | config | — | — |
| P0-15 | Add bounds checks to e1000d/rtl8139d/rtl8168d MMIO | drivers | HIGH | 1 hour |
| P0-16 | Replace panic! on failed BAR lookup | drivers | HIGH | 1 hour |
| P0-17 | dnsd unsafe mut → AtomicU16 | dnsd | CRITICAL | 1 hour |
| P0-18 | dnsd loopback shared cache via Arc<Mutex> | dnsd | CRITICAL | 4 hours |

### 9.2 P1 — FFI Safety & Error Handling (Near-Term, 2-3 weeks)

| ID | Action | Surface | Effort |
|----|--------|---------|--------|
| P1-1 | Add # Safety to all 99 unsafe blocks in relibc socket.rs | relibc | 2-3 days |
| P1-2 | Add # Safety to all 49 unsafe blocks in libredox | libredox | 1-2 days |
| P1-3 | Add # Safety to all 52 unsafe blocks in ethernet drivers | drivers | 1-2 days |
| P1-4 | Add # Safety to ~80 unsafe blocks in redox-driver-sys | driver-sys | 2-3 days |
| P1-5 | Change relibc Cargo.toml `missing_safety_doc = "deny"` | relibc | 5 min |
| P1-6 | Add [lints] section to libredox | libredox | 30 min |
| P1-7 | Fix `recvfrom` datagram truncation (P2-9) | relibc | 2-4 hours |
| P1-8 | Fix TCP SendMsg TODO (verify if stale) | relibc | 1 hour |
| P1-9 | Implement MSG_NOSIGNAL | relibc | 1-2 days |
| P1-10 | Change LinkDevice::send/recv to Result | netstack | 1 week |
| P1-11 | Fix conntrack `track()` dead is_orig (R002) | netstack | 1-2 days |
| P1-12 | Fix IPv6 extension header port filter bypass | netstack | 2-3 days |
| P1-13 | Pass `level` through SocketCall (fix option collision) | relibc/netstack | 3-5 days |
| P1-14 | Fix xHCI DMA pool lifetime (F1.3) | xhcid | 1 week |
| P1-15 | Fix xHCI ShortPacket handling (F1.10) | xhcid | 1 day |
| P1-16 | Add ACPI PRT query to pcid | pcid | 3-5 days |
| P1-17 | Add AML interpreter timeout/recursion limit | acpid | 2-3 days |
| P1-18 | Add IOMMU write fence | iommu | 30 min |
| P1-19 | Add IOMMU IVRS checksum validation | iommu | 1-2 hours |
| P1-20 | Fix usbhubd power-on inrush delay | usbhubd | 1-2 days |
| P1-21 | Fix wifictl IntelBackend timeout (F16) | wifictl | 1 day |
| P1-22 | Fix wifictl scheme state snapshot race (F17) | wifictl | 1-2 days |
| P1-23 | Fix iwlwifi bridge_tx_submit UAF (F7) | iwlwifi | 1-2 days |
| P1-24 | Fix iwlwifi key slice bounds (F4) | iwlwifi | 1 day |
| P1-25 | Fix iwlwifi SkBuff layout (F5) | iwlwifi | 1-2 days |
| P1-26 | Fix iwlwifi request_irq thread leak (F11) | linux-kpi | 1 day |
| P1-27 | Fix HciCommand::to_bytes saturation (F20) | btusb | 1 day |
| P1-28 | Fix ECDSA firmware panic | btintel | 30 min |

### 9.3 P2 — Test Coverage & Build Config (Medium-Term, 3-4 weeks)

| ID | Action | Effort |
|----|--------|--------|
| P2-1 | Add unit tests for TCP scheme (connect/listen/accept/send/recv/close) | 3-5 days |
| P2-2 | Add unit tests for Router (forwarding/TTL/ICMP/filter) | 3-5 days |
| P2-3 | Add unit tests for EthernetLink (ARP/NDP/SLAAC) | 2-3 days |
| P2-4 | Add unit tests for BufferPool (recycle/move_out/AsRef) | 1-2 days |
| P2-5 | Add unit tests for DHCP (DISCOVER/OFFER/REQUEST/ACK, RENEW/REBIND, options) | 3-5 days |
| P2-6 | Add unit tests for all 5 NIC drivers (mock MMIO, DMA ring, IRQ) | 1-2 weeks |
| P2-7 | Add tests for STP, SLAAC, conntrack::track() race | 1 week |
| P2-8 | Add xHCI integration tests (TRB ring, 36-error-code matrix) | 1-2 weeks |
| P2-9 | Add IOMMU tests (page table walks, IOVA alloc, cmd buffer) | 1 week |
| P2-10 | Add relibc unit tests (bind/connect/recvmsg/sendmsg/SCM_RIGHTS) | 1 week |
| P2-11 | Add libredox unit tests (demux, SocketCall, Fd::Drop) | 3-5 days |
| P2-12 | Fix recipe.toml version mismatches (0.1.0 → 0.3.1) | 1 hour (script) |
| P2-13 | Fix dhcpd Cargo.toml (version + deps) | 30 min |
| P2-14 | Fix iwlwifi build.rs (CARGO_MANIFEST_DIR + rerun-if-changed) | 1-2 hours |
| P2-15 | Add [patch.crates-io] to syscall Cargo.toml | 30 min |
| P2-16 | Refactor redbear-device-services.toml (deduplicate ~800 lines) | 2-3 hours |
| P2-17 | Add CLI gate to run host unit tests on every PR | 1-2 days |
| P2-18 | Replace unsafe libc in redbear-traceroute | 1 day |

### 9.4 P3 — Polish & Parity (Backlog)

See §12.5 of previous docs-assessment for full P3 list. Key items from this code audit:
- Implement SCM_RIGHTS (FD passing over UDS)
- Implement IP multicast (IGMPv3/MLDv2)
- Implement sendmmsg/recvmmsg
- Implement SO_TIMESTAMP/SO_TIMESTAMPNS
- Implement audiodevd source
- Implement usbd source
- Wire redbear-firmware-{amdgpu,intel,iwlwifi,bluetooth} download recipes
- DHCPv6 client
- A2DP/HFP/AVRCP Bluetooth profiles
- WPA3-SAE for Wi-Fi
- Wi-Fi roaming
- BPF/eBPF for observability

### 9.5 Effort Estimates

| Phase | 1 dev | 2 devs |
|-------|-------|--------|
| P0 (18 items) | 2-3 weeks | 1-2 weeks |
| P1 (28 items) | 4-6 weeks | 2-3 weeks |
| P2 (18 items) | 4-6 weeks | 2-3 weeks |
| P3 (14 items) | 6-12 months | 3-6 months |

### 9.6 Owner Assignments (suggestion)

- **P0-1 to P0-5, P1-1 to P1-15, P2-1 to P2-11** (memory safety, FFI docs, test gaps): Driver infrastructure + relibc owners
- **P0-12 to P0-14, P2-12 to P2-17** (config + build): Build system owner
- **P1-16 to P1-20, P2-8, P2-9** (driver correctness): Driver infrastructure + IOMMU owner
- **P1-21 to P1-28, P2-6** (wireless/BT/USB): Wi-Fi + BT owners
- **P0-8, P0-10, P1-19 to P1-22, P2-18** (daemons): Daemon + networking owner

---

## 10. Validation Plan

### 10.1 Validation Tiers
- **Host unit tests:** `cargo test` on Linux host
- **QEMU tests:** `local/scripts/test-*.sh` scripts
- **Bare-metal tests:** operator-reported with captured log

### 10.2 Per-Surface Validation Steps (post-P0 fixes)

| Surface | Validation |
|---------|-----------|
| Wired network | `cargo test` for netstack filter (31) + dhcpd (after fixes) + per-P0 regression |
| Wi-Fi | `cargo test` for linux-kpi (93) + iwlwifi (8) + wifictl (20) |
| Bluetooth | `cargo test` for btusb (151) + btctl (56) |
| USB | `test-xhci-irq-qemu.sh --check` + new P2 tests |
| relibc | Run `tests/sys_socket/shutdown.c` + new P2 tests |
| Daemons | New P2 tests + QEMU integration |
| Build | Run `./local/scripts/sync-versions.sh --check` + build all targets |

### 10.3 CI Regression Gates (Recommended)

- `cargo test` (host) on linux-kpi, iwlwifi, wifictl, btusb, btctl, fatd
- `cargo build` for all in-tree recipes
- `lint-config-paths.sh` for init service path violations
- `validate-init-services.sh` for override effectiveness
- **NEW:** `validate-recipe-toml-versions.sh` to enforce 0.3.1 across all recipes

### 10.4 Sign-off Criteria

A P0/P1/P2/P3 item is **signed off** when:
- Fix implemented on canonical branch
- Verified by corresponding test (host unit / QEMU / bare metal)
- Cross-referenced from §11 (file:line references)
- If maturity tier changes, canonical sub-plan updated

---

## 11. Appendix: Critical & High Findings Index

### 11.1 CRITICAL Findings (24)

| ID | File:Line | Description |
|----|-----------|-------------|
| C-01 | `local/sources/base/netstack/src/buffer_pool.rs:84-86` | Unsafe set_len exposes stale packet data |
| C-02 | `local/sources/relibc/src/platform/redox/socket.rs:888` | recvmsg unbounded msg_iovlen → heap corruption |
| C-03 | `local/sources/libredox/src/lib.rs:43` | demux().expect() panic on overflow edge case |
| C-04 | `local/recipes/drivers/redbear-btusb/source/src/btintel.rs:178-187` | ECDSA firmware blob slice panic |
| C-05 | `local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c:2687-2715` | UAF in rb_iwlwifi_bridge_tx_submit |
| C-06 | `local/sources/base/drivers/usb/xhcid/src/xhci/irq_reactor.rs:429-467` | IRQ reactor state re-entrancy race |
| C-07 | `local/sources/base/drivers/usb/xhcid/src/xhci/ring.rs:72-94` | phys_addr_to_index `>` should be `>=` |
| C-08 | `local/recipes/system/redbear-dnsd/source/src/transport.rs:236-290` | DNS compression pointer infinite loop |
| C-09 | `local/recipes/system/redbear-netctl/source/src/main.rs:248-258` | DHCP child zombie — handle dropped without wait |
| C-10 | `local/recipes/system/firmware-loader/source/src/main.rs:48-100` | .expect() crashes daemon on any error |
| C-11 | `local/recipes/system/redbear-btctl/source/src/main.rs:140-174` | btctl TOCTOU on .exists() then write |
| C-12 | `local/recipes/system/redbear-wifictl/source/src/scheme.rs:475-491` | WifiCtlScheme Key handle 0o644 world-readable |
| C-13 | `local/sources/base/netstack/src/filter/{stp,slaac}.rs` | Zero test coverage for STP and SLAAC |
| C-14 | `local/sources/base/dhcpd/src/main.rs` | Only 1 test for 422-line DHCP daemon |
| C-15 | `local/sources/base/drivers/net/{5 drivers}/src/*.rs` | Zero tests for all 5 NIC drivers |
| C-16 | `local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c:1740-1760` | Zero tests for iwlwifi ISR |
| C-17 | `local/sources/base/drivers/usb/xhcid/src/xhci/{trb,event,ring,scheme}.rs` | Zero xHCI integration tests |
| C-18 | `local/recipes/system/iommu/source/src/` | Zero IOMMU tests |
| C-19 | `local/recipes/system/redbear-dnsd/source/src/transport.rs:42-58` | unsafe static mut DNS_TID data race |
| C-20 | `local/recipes/system/redbear-dnsd/source/src/main.rs:83-125` | Loopback listener has no shared cache |
| C-21 | ~~`config/redbear-wifi-experimental.toml:9`~~ | **RESOLVED** — now `include = ["redbear-mini.toml"]` |
| C-22 | ~~`config/redbear-bluetooth-experimental.toml:10`~~ | **RESOLVED** — same |
| C-23 | ~~`local/recipes/system/redbear-passwd/recipe.toml`~~ | ~~Missing [source] section entirely~~ ✅ RESOLVED 2026-07-27 |
| C-24 | `config/redbear-device-services.toml:1-1137` | Firmware fallback blocks duplicated ~14 times |

### 11.2 HIGH Findings Index (Top 30)

| ID | File:Line | Description |
|----|-----------|-------------|
| H-01 | `local/sources/base/netstack/src/worker_pool.rs:61-65` | OwnedFd dups arbitrary raw fds |
| H-02 | `local/sources/base/netstack/src/scheme/mod.rs:181-182,193` | NIC fd double ownership |
| H-03 | `local/sources/base/drivers/net/e1000d/src/device.rs:248-254` | e1000d MMIO without bounds |
| H-04 | `local/sources/base/netstack/src/filter/conntrack.rs:285-296` | Dead is_orig variable |
| H-05 | `local/sources/relibc/src/platform/pal/socket.rs:11-98` | All 14 PalSocket trait methods unsafe with no docs |
| H-06 | `local/sources/relibc/src/platform/redox/socket.rs:35-69` | bind_or_connect unchecked sockaddr cast |
| H-07 | `local/sources/relibc/src/platform/redox/socket.rs:162-169` | inner_af_inet 4 .expect() panics |
| H-08 | `local/sources/relibc/src/platform/redox/socket.rs:278-341` | SCM_RIGHTS cmsg traversal overflow |
| H-09 | `local/sources/relibc/src/platform/redox/socket.rs:1055,1090` | sendto()/setsockopt() unwrap on as_c_fd() |
| H-10 | `local/sources/relibc/src/platform/redox/socket.rs:1028` | TCP SendMsg TODO may be stale |
| H-11 | `local/sources/base/drivers/usb/xhcid/src/xhci/irq_reactor.rs:548-565` | acknowledge_failed_transfer_trbs empty-states panic |
| H-12 | `local/sources/base/drivers/usb/xhcid/src/xhci/mod.rs:1133-1141` | DMA pool unsound lifetime gap |
| H-13 | `local/sources/base/drivers/usb/usbhubd/src/main.rs:201-400` | Hub power-on missing inrush delay |
| H-14 | `recipes/drivers/pcid/src/main.rs:153-233` | MSI clear without save, hardcoded IRQ 9 |
| H-15 | `recipes/drivers/pcid/src/main.rs:287-289` | Bus 0x80 unconditional scan |
| H-16 | `recipes/drivers/acpid/src/acpi.rs:74` | AML interpreter no timeout/recursion limit |
| H-17 | `local/recipes/system/iommu/source/src/command_buffer.rs:145-415` | No write fence before doorbell |
| H-18 | `local/recipes/drivers/redbear-iwlwifi/source/src/mld/dispatch.rs:270-277` | Key material out-of-bounds read |
| H-19 | `local/recipes/drivers/redbear-iwlwifi/source/src/bridge/callback.rs:34-44` | SkBuff layout mismatch |
| H-20 | `local/recipes/drivers/linux-kpi/source/src/rust_impl/irq.rs:60-82` | request_irq thread leak |
| H-21 | `local/recipes/system/redbear-wifictl/source/src/backend.rs:285-336` | IntelBackend spawns child with no timeout |
| H-22 | `local/recipes/system/redbear-wifictl/source/src/scheme.rs:392-421` | scheme:wifictl state snapshot race |
| H-23 | `local/recipes/drivers/redbear-btusb/source/src/hci.rs:129-138` | HciCommand::to_bytes saturates param_len |
| H-24 | `local/recipes/system/redbear-wifictl/source/src/scheme.rs:593-620` | TestBackend panics on multiple methods |
| H-25 | `local/recipes/system/redbear-netctl/source/src/main.rs:609-691` | Empty SSID accepted in parse_profile |
| H-26 | `local/recipes/system/firmware-loader/source/src/main.rs:91-99` | New SchemeState per request breaks multi-call |
| H-27 | `local/recipes/system/redbear-btctl/source/src/scheme.rs:335-417` | btctl scheme read refreshes bonds N+1 |
| H-28 | `local/recipes/system/redbear-btctl/source/src/bond_store.rs:181-207` | created_at_epoch silently defaults to 0 |
| H-29 | `local/recipes/system/redbear-authd/source/src/main.rs:190-193` | verify_encoded().unwrap_or(false) |
| H-30 | `local/recipes/system/redbear-sessiond/source/src/manager.rs:24-57` | Arc<Mutex<Option<Connection>>> race |

### 11.3 Audit Provenance

- Audits executed: 2026-07-27 14:00-14:13 JST
- Total session duration: ~30 minutes of parallel audit + ~30 minutes of synthesis
- Background tasks: bg_9aa16b38 (wired), bg_0d5adb88 (wireless+BT), bg_fea6ccf4 (USB+PCI+ACPI+IOMMU), bg_c02bfd4e (relibc+libredox), bg_741fba82 (daemons), bg_8ff53ad9 (test+build)

---

## 12. Glossary

- **scheme:** Redox's filesystem-namespace IPC primitive (`scheme:tcp`, `scheme:netcfg`)
- **relibc:** Redox's Rust-written POSIX libc
- **libredox:** Redox's userland FFI crate (syscall wrappers)
- **netstack / smolnetd:** Userspace TCP/IP daemon (smoltcp 0.13.1)
- **linux-kpi:** Linux Kernel Programming Interface shim
- **redox-driver-sys:** Safe Rust FFI for scheme:memory, scheme:irq, scheme:pci + quirks
- **iwlwifi / iwlwifi driver:** Intel Wi-Fi driver for 8 generations
- **btusb:** Bluetooth USB transport daemon (scheme:hciN)
- **btctl:** Bluetooth host daemon (scheme:btctl)
- **xhcid:** xHCI USB 3.x host controller daemon
- **dhcpd:** DHCPv4 client (one-shot, no renewal)
- **PAM:** Pluggable Authentication Modules
- **D-Bus:** Desktop IPC bus
- **zbus:** Pure-Rust D-Bus crate
- **relibc's PalSocket:** Trait defining unsafe POSIX socket operations

---

*End of document. For per-finding remediation, see §9 (roadmap) and §11 (file:line index).*

---

## 15. Implementation Status (Updated 2026-07-27)

This section tracks fixes applied since the original audit was performed. New fixes land
incrementally; this is a rolling changelog.

### 15.1 Fixed (Committed)

| ID | Surface | Commit | Files |
|----|---------|--------|-------|
| F001 / C-19 | dnsd AtomicU16 + compression loop | `01f4f5d958` | `local/recipes/system/redbear-dnsd/source/src/transport.rs` |
| F008 / 5.1 (io.rs) | redox-driver-sys SAFETY docs | `ec8af52952` | `local/recipes/drivers/redox-driver-sys/source/src/io.rs` |
| F008 (memory.rs static) | redox-driver-sys SAFETY docs | `0a559c2e18` | `local/recipes/drivers/redox-driver-sys/source/src/memory.rs` (MEMORY_ROOT_FD) |
| F008 (memory.rs MMIO) | redox-driver-sys SAFETY docs | `6debc2582e` | `local/recipes/drivers/redox-driver-sys/source/src/memory.rs` (MMIO + Drop + Send/Sync) |
| F008 (dma.rs) | redox-driver-sys SAFETY docs | `330175d801` | `local/recipes/drivers/redox-driver-sys/source/src/dma.rs` |
| F008 (pcid_client.rs) | redox-driver-sys SAFETY docs | `56d9ad6f7d` | `local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs` |
| **5.1 (bulk)** | **local/recipes: 590 SAFETY docs across 70 files** | `222d5186eb` | 70 files under `local/recipes/` |
| **9.2 (relibc)** | **relibc: 174 SAFETY docs across 4 files** | `1c3f5c8b` (submodule) → parent `b06c39d546` | `relibc/src/platform/redox/{socket,libredox,mod,signal}.rs` |
| **9.2 (libredox)** | **libredox: 45 SAFETY docs** | `d787867` (submodule) → parent `c0f792b856` | `libredox/src/lib.rs` |
| **9.2 (base)** | **base: 40 SAFETY docs across 9 files** | `a4a7d1a8` (submodule) → parent `97d5475b89` | `netstack/`, `dhcpd/`, `drivers/net/` |
| F18 / F18b | experimental.toml include fix | `91ba8ed481` | `config/redbear-{wifi,bluetooth}-experimental.toml` → `redbear-mini.toml` |
| F20 | 71 recipe.toml version sync (0.1.0 → 0.3.1) | `91ba8ed481` | 71 files under `local/recipes/*/recipe.toml` |
| F19 | Created `local/docs/networking-validation-log.md` | `b20f5f587b` | new file — references the non-existent path that NETWORKING-IMPROVEMENT-PLAN.md had cited |
| **CRITICAL F001** | **BufferPool zero-fill on recycle** | `submodule/base 3a3af825` → parent `22bd63bbe2` | `local/sources/base/netstack/src/buffer_pool.rs` |
| **CRITICAL F1.6** | **xHCI `>=` bounds check fix** | `submodule/base 3a3af825` → parent `22bd63bbe2` | `local/sources/base/drivers/usb/xhcid/src/xhci/ring.rs` |
| **DEF-P0-7** | rtl8139d/rtl8168d panic → graceful exit | `submodule/base 3a3af825` → parent `22bd63bbe2` | `local/sources/base/drivers/net/rtl{8139,8168}d/src/main.rs` |
| **DEF-P0-6** | e1000d MMIO register bounds check | `submodule/base 3a3af825` → parent `22bd63bbe2` | `local/sources/base/drivers/net/e1000d/src/device.rs` |
| **CRITICAL F1.1** | **xHCI re-entrancy: clear event TRB before state.finish()** | `submodule/base 51ae1567` → parent `4fc85b9be4` | `local/sources/base/drivers/usb/xhcid/src/xhci/irq_reactor.rs` (4 call sites) |
| **CRITICAL F3.1** | **libredox demux: replace .expect() with .unwrap_or(u16::MAX)** | `submodule/libredox bfb5f8b` → parent `7aba4f84ed` | `local/sources/libredox/src/lib.rs` |
| **CRITICAL F22** | **btintel ECDSA firmware length check** | `94c8b51b44` | `local/recipes/drivers/redbear-btusb/source/src/btintel.rs` (ECDSA_FULL_LEN = 964) |
| **P001 (firewalling)** | **IPv6 ext header firewall bypass fix** | `submodule/base f6780296` → parent `17367212dc` | `local/sources/base/netstack/src/router/mod.rs` (ipv6_transport_offset walker) |
| **CRITICAL F002** | **worker_pool from_raw_fd type tightening** | `submodule/base b19e0a64` → parent `146cd0dced` | `local/sources/base/netstack/src/worker_pool.rs` (RawFd not usize) |
| **CRITICAL F003** | **scheme File ownership redundant cast fix** | `submodule/base e3f87fa3` → parent `2356417820` | `local/sources/base/netstack/src/scheme/mod.rs` (2 sites) |
| **HIGH DEF-P0-7 (relibc)** | **MSG_NOSIGNAL: implement sigprocmask SIGPIPE blocking** | `submodule/relibc ccd379c6` → parent `f7f27a91f3` | `local/sources/relibc/src/platform/redox/socket.rs` (sendmsg + sendto) |
| **libredox API bug** | **Fd::ftruncate/futimens take &self, not self** | `submodule/libredox 5bb745e` → parent `cc37a2c08a` | `local/sources/libredox/src/lib.rs` |
| **HIGH DEF-P0-11 (option collision)** | **relibc passes level + netstack SocketT takes (level, name)** | `submodule/relibc 06bd61d0` + `submodule/base 181eb63d` → parent `689b9a9e5a` | `local/sources/relibc/src/platform/redox/socket.rs` (setsockopt/getsockopt wire format) + `local/sources/base/netstack/src/scheme/{socket,tcp,udp}.rs` (SocketT trait + impls) |
| **R002 (HIGH state-machine bug)** | **conntrack is_orig dead-variable fix** | `submodule/base 946d28d8` → parent `f381f9d40e` | `local/sources/base/netstack/src/filter/conntrack.rs` |
| **Single source of truth** | **libredox O_CLOEXEC references syscall** | `submodule/libredox 65889db` → parent `914e0e6a2e` | `local/sources/libredox/src/lib.rs` |
| **STALE TCP SendMsg TODO** | Removed (netstack does handle SocketCall::SendMsg at `local/sources/base/netstack/src/scheme/socket.rs:519-533`) | (same relibc commit) | `local/sources/relibc/src/platform/redox/socket.rs` (sendto) |
| **F21 (dnsd wiring)** | **Wire redbear-dnsd into redbear-mini** | `6b105c7cee` | `config/redbear-mini.toml` ([packages] + [init] 11_dnsd.service) |
| **ghost-recipe docs** | **netd/audiodevd/usbd WIP per AGENTS.md** | `6b105c7cee` | `local/recipes/system/{netd,audiodevd,usbd}/recipe.toml` |
| **local ssh recipe** | **net/openssh Red Bear fork with IPv6 detect + host-key gen** | `5656f8ccbe` | `local/recipes/net/openssh/recipe.toml` + `local/scripts/apply-patches.sh` symlink entry |

**SAFETY documentation totals:**
- 590 in local/recipes/* (parent 0.3.1 branch)
- 174 in relibc submodule (submodule/relibc branch)
- 45 in libredox submodule (submodule/libredox branch)
- 40 in base submodule (submodule/base branch)
- **Total: 849 SAFETY comments added**

**Stub/incomplete-code replacements this round:**
- openssh IPv4-only sed workaround → real IPv6 capability detection in local fork
- openssh host-key generation TODO → real postscript (idempotent, set -e)
- 3 ghost recipes (netd/audiodevd/usbd) → proper WIP documentation per AGENTS.md policy
- redbear-dnsd ghost-in-config (built but not wired) → wired into redbear-mini
- 71 recipe.toml version 0.1.0 → 0.3.1 (per AGENTS.md § VERSION CONVENTIONS)

### 15.2 Submodule Commits Pushed to origin

| Submodule | Branch | Commit | Parent pointer bump |
|-----------|--------|--------|---------------------|
| relibc | `submodule/relibc` | `1c3f5c8b` | `b06c39d546` |
| libredox | `submodule/libredox` | `d787867` | `c0f792b856` |
| base | `submodule/base` | `a4a7d1a8` | `97d5475b89` |

All three submodule branches pushed to origin.

### 15.3 Not Yet Addressed

Per the original audit's roadmap (§9 / §12), the following still need work:

| Area | Items |
|------|-------|
| **CRITICAL** (now down from 12 to 3) | BufferPool zero-fill ✅ DONE + completed with `v.resize(capacity, 0)`, xHCI `>=` bounds check ✅ DONE, xHCI re-entrancy ✅ DONE + completed with snapshot-before-clear, ECDSA firmware length check ✅ DONE locally, DNS demux panic fix ✅ DONE, IPv6 ext header firewall bypass ✅ DONE + completed (walker returns final protocol+offset, AH length formula corrected), rtl8139d/rtl8168d panic ✅ DONE, e1000d MMIO bounds ✅ DONE, F002 worker_pool RawFd ✅ DONE, F003 scheme File ownership ✅ DONE, TCP call() override for SendMsg+MSG_NOSIGNAL ✅ DONE, getsockopt todo_skip removed ✅ DONE. Remaining: ergonomic robustness on the worker_pool RawFd (signature now correct but comments still claim exclusivity), iwlwifi bridge unwraps. |
| **HIGH** (52 not yet touched) | 99 unsafe blocks in relibc socket.rs (partial SAFETY docs done; FFI semantics not yet documented), conntrack `track()` `is_orig` race, hardware checksum offload, etc. — see §6.3. Already addressed in this round: TCP SendMsg ✅, MSG_NOSIGNAL ✅, relibc option level collision ✅. |
| **MEDIUM** (84 not yet touched) | Most antipatterns, 50 silent error swallows, redundant error strategies — see §6.4 |
| **LOW** (37 not yet touched) | Cosmetic, naming — see §6.5 |
| **Stale docs** | Previous rounds confirmed NONE need removal (see §11.1). Round 6 cleanups already complete. Created `local/docs/networking-validation-log.md` for the previously missing reference. |
| **Submodule files (kernel)** | `local/sources/kernel/` — kernel syscall forks still pending audit/docs |
| **Submodule files (syscall)** | `local/sources/syscall/` — `SchemeSocketCall` / `CqeOpcode` still pending |
| **iwlwifi C transport** | `linux_port.c` (2,715 LOC) — primarily C, Rust SAFETY docs not applicable. Pending CI integration of static analysis. |

### 15.3a openssh IPv4 sed workaround — proper fix requires local fork

The audit identified the openssh recipe as having an `sed -i "s/#AddressFamily any/AddressFamily inet/g"`
workaround that hard-codes IPv4-only on every build (per AGENTS.md STUB AND WORKAROUND
POLICY: zero tolerance for sed/awk hacks).

**This round correctly did NOT edit `recipes/net/openssh/recipe.toml` directly.**
Per AGENTS.md: "DO NOT edit files under mainline `recipes/` directly — put patches in
`local/patches/`" and per the recipe format rules: "All source-tree edits MUST be
mirrored to `local/patches/` or `local/sources/<component>/` in the same session."

**The proper fix path** is one of:
1. **Create `local/recipes/net/openssh/` as a Red Bear fork recipe** that uses the
   same upstream tar but adds a Red Bear patch file (e.g.
   `local/patches/openssh/01-ipv6-capability-detect.patch`) implementing the
   capability-detection logic that replaces the sed. The cookbook's `apply-patches.sh`
   will symlink the patch into the build's working tree.
2. **Implement IPv6 in netstack/relibc** so the workaround is no longer needed at the
   openssh layer. This is the root-cause fix and is tracked under
   `local/docs/NETWORKING-IMPROVEMENT-PLAN.md` Phase 5.4 (Wi-Fi IP datapath bridge)
   and the relibc/socket.rs work in §3.4.

This remains a future task. The current sed workaround is documented in
`recipes/net/openssh/recipe.toml:48-49` and tracked for the next round.

### 15.4 Remaining Round Work (Next Round Priority)

Per the user's "Implement next round" directive, the next implementation round should
focus on the **defects themselves** (not just documentation):

1. **CRITICAL fixes** (§6.2) — actual code changes for F001, F002, F005-F012.
2. **HIGH FFI soundness** (§3.4) — implement TCP SendMsg, MSG_NOSIGNAL, fix option collision.
3. **HIGH error handling** (§3.5) — convert `LinkDevice::send/recv` to `Result`, fix conntrack `is_orig`.
4. ~~**Config cleanup**~~ — **RESOLVED** — `redbear-wifi-experimental.toml` and `redbear-bluetooth-experimental.toml` references to non-existent `redbear-minimal.toml` were renamed to `redbear-mini.toml` (see Finding 18/18b).
5. **Recipe.toml versioning** — sync 30+ recipe.toml `version = "0.1.0"` to `0.3.1` per
   `local/AGENTS.md § VERSION CONVENTIONS`.

### 15.5 Audit Provenance (this round)

- Branch: `0.3.1` (current Red Bear OS release branch)
- Date: 2026-07-27
- Total commits in this implementation round: 12 (including 4 submodule commits + 3
  parent submodule pointer bumps)
- All commits pushed to `origin/0.3.1`, `origin/submodule/relibc`,
  `origin/submodule/libredox`, `origin/submodule/base`

*End of implementation status. For original audit findings, see §1-14 above.*