# DF-1458 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
OOB stack read in cyapa_raw_input via unbounded device-reported finger count

## Source Location
sys/dev/smbus/cyapa/cyapa.c:1262-1490

## Verdict
Source-confirmed: OOB stack read in cyapa_raw_input via unbounded device-reported finger. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
cyapa_raw_input at cyapa.c:1262: nfingers=CYAPA_FNGR_NUMFINGERS(fngr) (0-15). touch[CYAPA_MAX_MT=5]. Loop i<nfingers indexes touch[i] for i>=5 -> OOB stack read of ~50 bytes past 27-byte regs struct. If debug sysctl on, OOB values printed to dmesg (info leak). Malicious device firmware or SMBus glitch. Fix: clamp nfingers=min(nfingers,CYAPA_MAX_MT).