# DF-1504 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
genkbd_get_fkeystr off-by-one bound (> instead of >=) permits one-element OOB read

## Source Location
sys/dev/misc/kbd/kbd.c:1119-1124

## Verdict
Source-confirmed: genkbd_get_fkeystr off-by-one bound (> instead of >=) permits one-elem. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
kbd.c:1119 genkbd_get_fkeystr gates array access with if (fkey > kb_fkeytab_size) instead of >=. When fkey (after -=F_FN) equals size, reads kb_fkeytab[size].len/str one element past end. GETFKEY/SETFKEY ioctls at 1075/1086 correctly use >=. Latent: in-tree callers pass [F_FN, L_FN]=[0x1b,0x7a] -> after subtract [0,95] and kb_fkeytab_size=NUM_FKEYS=96. Exposed if driver registers fkeytab_size<96 or caller passes F_FN+size. Fix: change > to >=, also add fkey<0 guard.