# DF-1378 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
Off-by-one NUL write past bt->model[5] in bt_fetch_adapter_info on every attach

## Source Location
sys/dev/disk/buslogic/bt.c:420-425

## Verdict
Source-confirmed: Off-by-one NUL write past bt->model[5] in bt_fetch_adapter_info on eve. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
bt_fetch_adapter_info at bt.c:420-425: for(i=0;i<sizeof(ascii_model)=5;i++) model[i]=ascii_model[i]; if space break. model[5] (btreg.h:638). No space in 5 bytes -> i=5 -> model[5]=\0 one past end. model is LAST field of bt_softc -> writes 1 byte past allocation. Fix: i<sizeof(model)-1, break on space or NUL.