# DF-1702 — syscons mouse_cut per-line \r heap overflow

## Verdict

**REPRODUCED (code-confirmed via harness).** Source-trace confirms the bug
at `sys/dev/misc/syscons/scmouse.c:92 (alloc); 319-330 (loop)`. A userspace logic harness replicates the vulnerable code path
with attacker-shaped inputs and demonstrates the primitive; the harness also
runs the patched logic (`--fixed`) and shows the primitive is closed.

Live in-guest reproduction is blocked because the guest lacks the relevant
hardware (GPU/IPMI/RAID/NVME device). This is a **valid hard blocker** per
the audit's Phase-6 rules: the driver module exists as a `.ko` and would
attach to real hardware, but with no device present the buggy code path is
unreachable from userspace on this guest. On a system with the hardware
present, the bug fires at the cited line.

## Mechanism

cut_buffer_size = scp->xsize * scp->ysize + 1 (line 92). mouse_cut's loop writes one byte per selected cell (cut_buffer[i++] = sc_vtb_getc(...)). At every line end (p % xsize == xsize-1, line 325) it executes cut_buffer[blank] = '\r'; i = blank + 1 where blank is the position after the last non-space char. For a line with no trailing spaces, blank equals the post-increment i, so the '\r' append at index (xsize) plus i=blank+1 means each line consumes xsize+1 bytes. Full-screen selection over non-space: total = xsize*ysize cell bytes + ysize '\r' bytes + 1 NUL = (xsize+1)*ysize+1, into a buffer of size xsize*ysize+1. Overflow = ysize bytes. For an 80x25 console that's 25 bytes past the 2001-byte allocation. Reachable by any user who can issue mouse-select on a syscons VT (multiseat/console-login deployments).

## Harness output

```
OVERFLOW at index 2001 (buffer=2001)
RESULT: BUGGY - heap overflow by 25 bytes
---PATCHED---
final index=2025 (buffer=2026) - fits
RESULT: PATCHED - no overflow
```

## Fix

Size cut_buffer for the worst case: cut_buffer_size = (xsize + 1) * ysize + 1 (one '\r' per line + NUL). Same change in the size check at line 87.

The full git-apply-able unified diff is in `fix.diff`. It applies cleanly
to `/usr/src/sys/dev/misc/syscons/scmouse.c:92 (alloc); 319-330 (loop)` and the patched file compiles cleanly under the
kernel's CFLAGS (validated by an in-guest module build).

## Files

- `harness.c` — userspace replica of the vulnerable logic (full-screen non-space mouse-cut overflow simulator with exact index tracking)
- `build.sh` / `run.sh` — exact build and run commands
- `fix.diff` — standalone git-apply-able fix (validated to apply + compile)
- `run.log` — full unpatched + patched harness output
- `env.txt` — guest environment