# DF-1552 VERDICT

**Verdict:** REPRODUCED (source-confirmed)

**Impact:** Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

**Mechanism:** if_sn.c:140 static const char *chip_ids[15] (indices 0..14). 175-176 kprintf(%s, chip_ids[(rev>>4)&0xF]); 1303 sn_probe if (!chip_ids[(revision_register>>4)&0xF]). & 0xF yields 0..15 so index 15 reads

**Citation:** `sys/dev/netif/sn/if_sn.c:140-176`

**Fix:** Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

**Verification method:** Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.