=== DF-1012 trigger documentation ===

Vulnerable path (device-attach time):
  uvc_attach -> uvc_drv_parse_data (uvc_drv.c:1776)
    fmt = data->fmt - 1;            // uvc_drv.c:1836
    while (desc = usbd_find_descriptor(...)) {
        case UDESCSUB_VS_COLORFORMAT:
            fmt->colorspace = ...;   // writes data->fmt - 66
        case UDESCSUB_VS_FRAME_*:
            fmt->nfrm++;             // writes data->fmt - 88
    }
Trigger precondition: a malicious USB UVC webcam whose
  descriptor list emits a VS_COLORFORMAT or VS_FRAME_*
  descriptor BEFORE any VS_FORMAT_* descriptor.
Effect: heap underflow write 66..88 bytes before the
  data->fmt allocation; corrupts slab metadata / adjacent
  objects -> write-what-where primitive on a remote-capable
  attacker-controlled device.

Status on this audit guest (no USB UVC device attached):
  NOT REACHABLE. Bug confirmed by code trace at
  sys/bus/u4b/uvc/uvc_drv.c:1836-1846 and 1924. Fix: track a
  fmt_seen flag and skip the COLORFORMAT / FRAME writes until
  the first VS_FORMAT descriptor has executed fmt++. See
  fix.diff and VERDICT.md.
RUN_EXIT=0