# DF-1436 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
Off-by-up-to-7-bytes OOB read of ADMA2 descriptor table in sdhci_adma_irq error-path logger

## Source Location
sys/dev/disk/sdhci/sdhci.c:1735-1742

## Verdict
Source-confirmed: Off-by-up-to-7-bytes OOB read of ADMA2 descriptor table in sdhci_adma_. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
sdhci_adma_irq at sdhci.c:1735-1742: addr < busaddr + SDHCI_ADMA2_DESCBUF_SIZE(4096) permits addr=4095. desc=addr, sizeof(desc)=8. desc->attribute(0-1)/length(2-3)/address(4-7) read 1-7 bytes past descriptor DMA allocation. Leaked bytes emitted via slot_printf to dmesg (world-readable). Trigger: ADMA2 error interrupt from malicious SD card or DMA glitch. Fix: addr+sizeof(*desc) <= busaddr+DESCBUF_SIZE.