DF-1283 / run.log
[DF-1283] mapping_table max_devices=264, sizeof(entry)=32 --- Case A: slot too large (firmware u16, no upper bound) --- [DF-1283] start_index=10 slot=300 start_slot=0 -> map_idx=310 (0x136) [DF-1283] BUG: map_idx=310 >= max_devices=264 -> write at mapping_table[310] --- Case B: unsigned underflow (slot < start_slot) --- [DF-1283] start_index=0 slot=0 start_slot=5 -> map_idx=4294967291 (0xfffffffb) [DF-1283] BUG: map_idx=4294967291 >= max_devices=264 -> write at mapping_table[4294967291] -- WILD POINTER (in-kernel: out-of-slab write / panic; in userspace: SIGSEGV) [DF-1283] RESULT: OOB write into adjacent slab region DEMONSTRATED --- Fix demonstration --- [DF-1283] FIX: map_idx=310 >= max_devices=264 -> SKIP write (no corruption) RUN_EXIT=0