DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
cc 8.3 [DragonFly] Release/2019-02-22
=== harness: BUGGY build ===
bCtrlSize=32  bCtrlSize*8=256  nctrls(set bits)=1
iterations executed: 2147487745 (cap=2000000)
writes IN-BOUNDS   : 1 (expected nctrls=1)
writes OUT-OF-BOUNDS: 4096  <-- UNBOUNDED HEAP OVERFLOW (primitive confirmed)
first OOB write at iter 1 (i had wrapped at least once)

VERDICT: BUGGY — uint8_t i wraps when bCtrlSize*8 > 255;
        the loop fails to terminate and writes struct uvc_control
        entries (with pointers / nested kmallocs) past the allocation.

=== harness: FIXED build ===
bCtrlSize=32  bCtrlSize*8=256  nctrls(set bits)=1
iterations executed: 1 (cap=2000000)
writes IN-BOUNDS   : 1 (expected nctrls=1)
writes OUT-OF-BOUNDS: 0

VERDICT: FIXED — unsigned int i holds the full range; loop
        terminates after exactly nctrls in-bounds writes.
bCtrlSize=64  bCtrlSize*8=512  nctrls(set bits)=1
iterations executed: 1 (cap=2000000)
writes IN-BOUNDS   : 1 (expected nctrls=1)
writes OUT-OF-BOUNDS: 0

VERDICT: FIXED — unsigned int i holds the full range; loop
        terminates after exactly nctrls in-bounds writes.
bCtrlSize=245  bCtrlSize*8=1960  nctrls(set bits)=1
iterations executed: 1 (cap=2000000)
writes IN-BOUNDS   : 1 (expected nctrls=1)
writes OUT-OF-BOUNDS: 0

VERDICT: FIXED — unsigned int i holds the full range; loop
        terminates after exactly nctrls in-bounds writes.