# DF-1066 — UVC mmap offset integer underflow (`buf_size==0` -> arbitrary `vtophys`)

## Verdict (this run)
**SOURCE-CONFIRMED, NOT REPRODUCED AT RUNTIME on this guest** — the underflow
and dead signed checks are traced line-by-line in compiled module source
(`uvc.ko` ships in `/boot/kernel`), but the UVC driver never attaches here (no
USB camera, no `/dev/video*`). The fix (`fix.diff`) **applies and compiles**
(`uvc.ko` rebuilt clean under `-Werror`).

## How to reproduce (HW-equipped host)
1. `./build.sh && ./run.sh` — opens `/dev/video0`, S_FMT (camera supplies
   `dwMaxFrameSize==0`), REQBUFS (→ `bq->buf_size==0`, underflow), then `mmap`
   with crafted offset; `vtophys(bq->mem + offset)` maps an arbitrary physical
   page read/write into the process.
2. Requires: a malicious/probe-failing UVC camera (probe returns
   `dwMaxFrameSize==0`) so `uvc.ko` loads and `/dev/video0` exists (mode `0666`).

## Why not on this guest
No USB camera; `uvc.ko` not loaded; no `/dev/video*`. The trigger cannot `open()`
a device. Dormant code path, not absent.

## Files
- `poc_uvc_oob.c` — intended mmap-offset trigger (documented).
- `fix.diff` — reject `buf_size==0`/`buf_count==0`, overflow-safe multiply,
  unsigned compare; reject `len==0` in `req_bufs`.
- `uvc_fix_build.log` — proof the fix compiles (`-Werror`, rc=0).
- `VERDICT.md` — full line-by-line trace.