Correct the behavior of ndis_adjust_buflen(): the NDIS spec says

it's an error to set the buffer bytecount to anything larger than
the buffer's original allocation size, but anything less than that
is ok.

Also, in ndis_ptom(), use the same logic: if the bytecount is
larger than the allocation size, consider the bytecount invalid
and the allocation size as the packet fragment length (m_len)
instead of the bytecount.

This corrects a consistency problem between the Broadcom wireless
driver and some of the ethernet drivers I've tested: the ethernet
drivers all report the packet frag sizes in buf->nb_bytecount, but
the Broadcom wireless driver reports them in buf->nb_size. This
seems like a bug to me, but it clearly must work in Windows, so
we have to deal with it here too.

2 files changed, 11 insertions, 4 deletions

diff --git a/sys/compat/ndis/kern_ndis.c b/sys/compat/ndis/kern_ndis.c
index 0433f7d..3aca08f 100644
--- a/sys/compat/ndis/kern_ndis.c
+++ b/sys/compat/ndis/kern_ndis.c
@@ -464,7 +464,7 @@ ndis_ptom(m0, p)
 		 * set up the free mechanism in the first mbuf of the
 		 * chain.
 		 */
-		if (buf->nb_size)
+		if (buf->nb_bytecount > buf->nb_size)
 			m->m_len = buf->nb_size;
 		else
 			m->m_len = buf->nb_bytecount;
diff --git a/sys/compat/ndis/subr_ndis.c b/sys/compat/ndis/subr_ndis.c
index f45b602..41a9442 100644
--- a/sys/compat/ndis/subr_ndis.c
+++ b/sys/compat/ndis/subr_ndis.c
@@ -467,6 +467,11 @@ ndis_read_cfg(status, parm, cfg, key, type)
 	TAILQ_FOREACH(e, &sc->ndis_ctx, link) {
 		oidp = e->entry;
 		if (strcmp(oidp->oid_name, keystr) == 0) {
+			if (strcmp((char *)oidp->oid_arg1, "UNSET") == 0) {
+				free(keystr, M_DEVBUF);
+				*status = NDIS_STATUS_FAILURE;
+				return;
+			}
 			*status = ndis_encode_parm(block, oidp, type, parm);
 			free(keystr, M_DEVBUF);
 			return;
@@ -486,9 +491,11 @@ ndis_read_cfg(status, parm, cfg, key, type)
 	 */
 
 	if (type == ndis_parm_int || type == ndis_parm_hexint)
-		ndis_add_sysctl(sc, keystr, NULL, "0", CTLFLAG_RW);
+		ndis_add_sysctl(sc, keystr, "(dynamic integer key)",
+		    "UNSET", CTLFLAG_RW);
 	else
-		ndis_add_sysctl(sc, keystr, NULL, "", CTLFLAG_RW);
+		ndis_add_sysctl(sc, keystr, "(dynamic string key)",
+		    "UNSET", CTLFLAG_RW);
 
 	free(keystr, M_DEVBUF);
 	*status = NDIS_STATUS_FAILURE;
@@ -1502,7 +1509,7 @@ ndis_adjust_buflen(buf, len)
 	ndis_buffer		*buf;
 	int			len;
 {
-	if (buf->nb_bytecount > len)
+	if (len > buf->nb_size)
 		return;
 	buf->nb_bytecount = len;