DF-1058 / run.log
open /dev/fw0: No such file or directory (errno=2) No FireWire controller on this guest — source-level analysis only. BUG CONFIRMED at fwdev.c:391-392: fp->mode.stream.len is user- controlled with no validation against it->psize. Overflow of up to ~64KB per packet into adjacent heap.