# DF-1500 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unbounded ksprintf into fixed 8-byte schan.hookname in musycc_newhook

## Source Location
sys/dev/misc/musycc/musycc.c:167-1077

## Verdict
Source-confirmed (complex fix): Unbounded ksprintf into fixed 8-byte schan.hookname in musycc_newhook. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
musycc.c:1077 musycc_newhook: ksprintf(sch->hookname, name) /* XXX overflow ? */ into char hookname[8] (167). name is netgraph hook name, capped at NG_HOOKSIZ=32 bytes via NGM_CONNECT/NGM_MKHOOK ourhook[NG_HOOKSIZ]. ts1,2,3,4,5,6,7,8,9,10,11,12,13 = 31 chars -> ksprintf writes 32 bytes into hookname[8] overruns 24 bytes into hook/rx_drop/tx_limit. hook reassigned at 1085, tx_limit at 1086, but rx_drop never re-zeroed, holds attacker ASCII bytes. Confined to stats counter not exposed today -> lat