# DF-1597 VERDICT

**Verdict:** REPRODUCED (source-confirmed)

**Impact:** Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

**Mechanism:** tpm.c:1273 n = MIN(sizeof(buf), uio->uio_resid) -> n=0 for write(fd,buf,0). 1284 tpm_tis12_write(sc, buf, 0) NO early return. 820-825 while (cnt < len-1) where cnt is size_t and len is int; len=0 -> l

**Citation:** `sys/dev/crypto/tpm/tpm.c:821-1284`

**Fix:** Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

**Verification method:** Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.