# DF-1007 source-confirmation

**Verdict:** REPRODUCED (source-confirmed)
**Impact:** none  **Confidence:** likely

**Kernel ref:** `sys/bus/firewire/fwohci.c:1406`

## Mechanism
fwohci db[-1] OOB write on add_rx_buf ENOMEM: fwohci_rx_enable/tx_enable ignore fwohci_add_rx_buf return; on ENOMEM dbcnt stays 0 so ldesc=dbcnt-1=-1 indexes db[-1] (8-byte OOB write before descriptor array). confirmed.

## Confirmation method
source-only Low-severity; confirmation by code inspection. Runtime PoC not exercised for this Low-severity item; confirmation is by code inspection against `sys/`.

## Recommended fix
See `fix.diff` in this folder (git-apply-able unified diff).

## Phase 8 (combined build)
This fix is part of the batched 70-finding combined patch
(`../_batch70/combined_70.patch`) applied to in-guest `/usr/src`. A single
`make -j6 nativekernel KERNCONF=X86_64_GENERIC` build is validated rc=0 with 0
errors under -Werror (`../_batch70/fix_build.log`).