# DF-1962 VERDICT

**Verdict:** REPRODUCED (source-confirmed)

**Impact:** Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

**Mechanism:** powernow.c L343 static char freqs_available[80]. L380 freq_len=n_states*(sizeof(9999 )-1)+1 = n_states*5+1 = 81 for max 16 states. L386 ksnprintf(freqs_available+len,freq_len-len,...) uses freq_len NO

**Citation:** `sys/dev/powermng/powernow/powernow.c:343-386`

**Fix:** Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

**Verification method:** Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.