# PoC DF-1494: midistat_read negative uio_offset → OOB read

**Class:** kernel OOB read
**Cited site:** `sys/dev/sound/midi/midi.c:1038-1042`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No on this guest — sound subsystem (sound.ko, includes midi.c) is not loaded; the audit guest has no audio HW. Trigger requires sound.ko loaded and a lseek to a negative offset on /dev/midistat (devfs permits it).

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/sound/midi/midi.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 1038 `l = min(uio->uio_resid, sbuf_len(&midistat_sbuf) - uio->uio_offset);` — uio_offset is `off_t` (signed). When truncated to u_int by min() (libkern.h:76, both args are u_int), a negative offset becomes a huge unsigned, so the subtraction overflows and l becomes a giant value. Line 1041 `uiomove(sbuf_data + uio->uio_offset, l, uio)` then reads gigabytes of kernel memory past sbuf_data into userspace. devfs_fo_seek (devfs_vnops.c:1664-1669) permits negative seeks.

## Realistic impact ceiling

leak (info leak / DoS)

## Fix

Clamp uio_offset to [0, sbuf_len-1] before the min/uiomove; return 0 on out-of-range.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1494.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1494.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/sound/midi && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```