# DF-1066 — VERDICT

## Verdict
**SOURCE-CONFIRMED (real bug), NOT REPRODUCED AT RUNTIME on this guest.**
The integer underflow and the dead signed checks are traced line-by-line in
compiled module source. It does not fire here because the UVC driver never
attaches (no USB camera, no `/dev/video*`). Dormant code path, **not** a false
positive (`uvc.ko` ships in `/boot/kernel`).

## Mechanism (source trace)
1. `uvc_buf_queue_mmap_locked` (`uvc_buf.c:107`):
   `uint64_t max_offset = (uint64_t)(bq->buf_size * bq->buf_count) - PAGE_SIZE;`
   When `buf_size == 0`, `0 - PAGE_SIZE` in `uint64_t` wraps to
   `0xFFFFFFFFFFFFF000`.
2. `:112` `if (offset < 0)` and `:115` `if (max_offset < 0)` are **dead code**:
   `offset` is `vm_offset_t` (`unsigned long`) and `max_offset` is `uint64_t`;
   both compare-unsigned-to-0-literal and can never be true.
3. `:118` `if (offset > max_offset)` therefore passes for any offset below the
   wrapped value (covers the entire kernel VA range).
4. `:126` `*paddr = atop(vtophys((uint8_t *)bq->mem + offset))` then translates
   an attacker-chosen VA. `bq->mem` is the special zero-length pointer from
   `kmalloc(0)`; `vtophys(va)=pmap_kextract(va)` returns the physical address
   for any valid kernel DMAP VA. The device pager maps that physical page
   read/write into the process.
5. `buf_size == 0` is reachable: `req_bufs` sets `buf_size = round_page(len)`
   (`uvc_buf.c:~580`); `len = UGETDW(v->req.dwMaxFrameSize)` (`uvc_v4l2.c:621`).
   A camera probe returning `dwMaxFrameSize == 0` (`uvc_drv.c:674`) — a
   malicious/probe-failing UVC device — drives `len == 0`; `uvc_drv_fixup_req`
   (`uvc_drv.c:300-305`) only corrects uncompressed formats and also yields 0
   for width/height/bpp == 0. `kmalloc(num*0==0)` returns a non-NULL zero-length
   pointer, so `req_bufs` proceeds and the mmap path is live.
6. Reachability for an unprivileged user: `/dev/videoN` is `0666`
   (`uvc_v4l2.c:784`). Real precondition is an attached UVC camera whose probe
   returns `dwMaxFrameSize == 0`.

## Why not reproduced here
No USB camera; `uvc.ko` not loaded; `/dev/video*` absent. The trigger cannot
`open()` a device.

## Fix
`fix.diff` rejects the degenerate queue (`mem==NULL || buf_size==0 ||
buf_count==0`), guards the `buf_size*buf_count` multiplication against `uint64`
overflow, requires `total >= PAGE_SIZE` before subtracting, compares both
operands as `uint64_t`, removes the dead signed checks, and rejects `len==0` in
`req_bufs`. **Matches** the finding's proposal (with the same overflow guard and
explicit zero-state rejection). The durable hardening is for `uvc_v4l2.c` to
treat a `req_bufs` `EINVAL` as fatal for streaming setup.

## Fix validation (compile)
**Applies** (`git apply --check` clean) and **compiles**: `uvc.ko` rebuilt from
patched source under `-Werror`, `uvc_buf.c` compiled clean, rc=0. Runtime
before/after is **not_testable** (no HW to trigger).

## Exploit chain (n/a — unreachable at runtime on this guest)
No chain developed; the primitive (arbitrary kernel-VA→physical-page read/write)
is unreachable here. On a HW-equipped host this is a direct kernel-memory
arbitrary R/W from an unprivileged process → trivial `uid=0` (read/overwrite a
`struct ucred`, page tables, etc.).