# DF-1217 — bktr unprivileged I2C / EEPROM / GPIO access

## Reproduce

Not runnable on the audit guest — no Brooktree capture card is attached. The
verification is a static source trace + a compiling `fix.diff`.

To **validate the fix compiles** as a standalone module:
```sh
cd /usr/src/sys/dev/video/bktr
make obj
make
ls /usr/obj/usr/src/sys/dev/video/bktr/bktr/bktr.ko
```

## Bug location
`sys/dev/video/bktr/bktr_core.c:1202` (`video_ioctl`) dispatches hardware-
control ioctls (`BT848_WEEPROM`, `BT848_I2CWR`, `BT848_GPIO_SET_EN`,
`BT848_GPIO_SET_DATA`, `BT848_MSP_WRITE`, `BT848_MSP_RESET`) with **no
privilege check**. Device is created mode 0444 at `bktr_os.c:325` so any
local user can open and issue them.

## Trigger preconditions (NOT met on this guest)
- A Bt848/Bt878 capture card and `bktr.ko` loaded so `/dev/bktrN` exists.

## On a system WITH the card, the PoC is:
```c
int fd = open("/dev/bktr0", O_RDONLY);
u_long i2c = (1UL<<24) | (addr<<16) | (port<<8) | data;   /* write=1 */
ioctl(fd, BT848_I2CWR, &i2c);   /* UNFIXED: 0; FIXED: -1 errno=EPERM */
```

## Files
- `VERDICT.md`, `fix.diff`, `env.txt`, `module_build.log`.