# DF-1372 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
oce_handle_passthrough writes through direct user-pointer dereference (SMAP panic)

## Source Location
sys/dev/netif/oce/oce_if.c:1806-1861

## Verdict
Source-confirmed (complex fix): oce_handle_passthrough writes through direct user-pointer dereference . No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
oce_handle_passthrough at oce_if.c:1858: fw_cmd=(struct mbx_common_get_cntl_attr*)ioctl_ptr (user pointer). strncpy(fw_cmd->...drv_ver_str,...). Supervisor write to user address -> SMAP fault -> panic. All other data motion uses copyin/copyout. Triggered by opcode=OPCODE_COMMON_GET_CNTL_ATTRIBUTES. Root/cap. Fix: stamp version in DMA buffer before copyout.