=== (1) large-tag length bytes consumed but not subtracted from scanning ===
	while (scanning > 0) {
		tag = *resp++;
		scanning--;
		if (PNP_RES_TYPE(tag) != 0) {
			/* Large resource */
			if (scanning < 2) {
				scanning = 0;
				continue;
			}
			large_len = resp[0] + (resp[1] << 8);
			resp += 2;

			if (scanning < large_len) {
				scanning = 0;
				continue;
			}
			resinfo = resp;
			resp += large_len;
			scanning -= large_len;

			if (PNP_LRES_NUM(tag) == PNP_TAG_ID_ANSI) {

=== (2) sibling parsers in pnpparse.c DO subtract the 2 length bytes ===
			if (len < 2) {
				len = 0;
				break;
			}
			l = I16(p);
			p += 2;
			len -= 2;
			if (len < l) {
				len = 0;
				break;
			}
			len -= l;
			if (start == NULL &&
			    pnp_parse_desc(dev, tag, p, l, config, ldn)) {
				len = 0;
				break;
---
		} else {
			/* large resource */
			if (len < 2)
				break;
			l = I16(p);
			p += 2;
			len -= 2;
			if (len < l)
				break;
			if ((*cb)(dev, tag, p, l, config, ldn))
				return (p + l);
		}
		p += l;
		len -= l;

=== (3) pnp.c is built into the default kernel (device isa is configured) ===
58:device		isa
100:device		adv0	at isa?
151:device		atkbdc0	at isa? port IO_KBD
155:device		vga0	at isa?
179:device		lm0	at isa? port 0x290
180:device		it0	at isa?	port 0x290
181:device		it1	at isa?	port 0xc00
182:device		it2	at isa?	port 0xd00
183:device		it3	at isa?	port 0x228
184:device		wbsio0	at isa? port 0x2e
185:device		wbsio1	at isa? port 0x4e
203:device		sio0	at isa? port IO_COM1 flags 0x10 irq 4
204:device		sio1	at isa? port IO_COM2 irq 3
205:device		sio2	at isa? disable port IO_COM3 irq 5
206:device		sio3	at isa? disable port IO_COM4 irq 9
278:device		lnc0	at isa? disable port 0x280 irq 10 drq 0
279:device		sn0	at isa? disable port 0x300 irq 10
2124:bus/isa/pnp.c			optional isa

=== (4) pnp_identify runs every boot but finds 0 PnP cards in the audit guest ===
(no pnp device lines above = isolation protocol found no PnP cards; the
 vulnerable loop in pnp_create_devices is never entered)

DONE: all four static checks executed.