=== DF-1083 verification environment ===
Guest: DragonFly 6.5-DEVELOPMENT (master DEV build) on QEMU/KVM
Kernel tested (baseline, unpatched): 6.5-DEVELOPMENT #0  Thu Jul  2 06:02:54 UTC 2026
Kernel tested (single-fix):          6.5-DEVELOPMENT #1  Thu Jul 16 04:03:37 UTC 2026
uname -a: DragonFly dfbsd 6.5-DEVELOPMENT #1 x86_64
cc:      cc 8.3 [DragonFly] Release/2019-02-22
user:    maxx (uid 1001) for harness build/run; root for kernel build/boot

FireWire in GENERIC (statically linked, NOT just a module):
  sys/config/X86_64_GENERIC:
    device  firewire   # FireWire bus code
    device  sbp        # SCSI over FireWire
    device  fwe        # Ethernet over FireWire
  nm /boot/kernel/kernel: crom_next at 0xffffffff804bdc90  (in-kernel)

Vulnerable file: sys/bus/firewire/fwcrom.c
Vulnerable line: 115  (if (cc->depth >= CROM_MAX_DEPTH))
Struct array:    iec13213.h:208  struct crom_ptr stack[CROM_MAX_DEPTH]  (CROM_MAX_DEPTH=10)
Callers (stack-allocated struct crom_context cc):
  sys/dev/disk/sbp/sbp.c:405  sbp_alloc_lun()
  sys/dev/disk/sbp/sbp.c:549  sbp_alloc_target()
  sys/dev/disk/sbp/sbp.c:595  sbp_alloc_dev()  (via crom_has_specver inline)

No FireWire controller in QEMU guest -> harness compiles verbatim crom_* code.
Harness: cc -O0 -g -o harness harness.c  (ASan unavailable: no libasan on guest)