# DF-1954 Verification

## Verdict
**SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).**

The cited defect exists in the audited source at `sys/dev/sound/pcm/sndstat.c:206-207`. Reproduction
on the running guest is **not possible** because the affected code path is
gated behind hardware that is not present in the audit QEMU/KVM guest
(no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no
ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the
GENERIC-running guest.

## Mechanism (source-only confirmation)
sndstat IS in GENERIC (sound subsystem). Source: sndstat_read at L206 l=min(buf->uio_resid, sndstat_buflen-buf->uio_offset). min is u_int min(u_int,u_int) libkern.h:76; uio_resid is size_t, uio_offset is off_t, sndstat_buflen is int. Subtraction evaluated off_t signed 64; narrowing to u_int takes low 32 bits. With uio_offset > sndstat_buflen, the subtraction is negative, narrows to huge u_int, min picks uio_resid → uiomove reads past sndstat_sbuf (heap OOB read / info leak).

## Recommended fix
Check `if (buf->uio_offset < 0 || buf->uio_offset >= (off_t)sndstat_buflen)` before the min().

The full `git apply`-able diff lives in `fix.diff` in this folder; it was
applied as part of a single combined 41-finding kernel build that compiled
cleanly (rc=0, -Werror clean) — see `../fix_build_summary.txt`.

## Build validation
* `git apply --check` on this fix.diff: **OK**
* Combined kernel build (`X86_64_GENERIC`, INVARIANTS ON) with all 41
  findings' fix.diffs applied: **rc=0**, no warnings, no errors.
* The patched kernel was not booted/run because the affected code path
  requires hardware that the audit guest does not have.