# DF-1060 — FW_GTPMAP bcopy with attacker-inflatable crc_len (OOB read)

## Summary
`FW_GTPMAP` at `sys/bus/firewire/fwdev.c:657-660` copies
`(sc->fc->topology_map->crc_len + 1) * 4` bytes from `topology_map`
to the user buffer. `crc_len` is `uint16` and is incremented once per
self-id packet in `fw_sidrcv` (`firewire.c:1143`) without bound; the
topology_map allocation is only ~1036 bytes. With `crc_len` inflated,
the bcopy leaks up to 256 KB of adjacent kernel heap into user memory.

## HW / preconditions
- FireWire PCI host controller (no `fwohci` attachment, no `/dev/fw*` on this QEMU guest).
- AND a malicious/buggy FireWire device that floods self-id packets to inflate `crc_len`.

Doubly-unreachable on this guest — code-confirmed only.

## Build / Run
No buildable PoC (no `/dev/fw*`). `./build.sh && ./run.sh` print the
situation. The bug is documented in `fw_gtpmap_oob_read.c`.

## Fix
`fix.diff` caps `crc_len` at `sizeof(struct fw_topology_map)/4 - 1` so
the bcopy can never read past the allocation. A full fix would also
bound the self-id loop in `fw_sidrcv`; that is out of scope here.