# DF-2024 PoC — size_t underflow in multi-part SSIF write loop

**Status:** `inconclusive` / reproduced=0 — **HW-GATED** (IPMI SSIF needs a BMC on an
SMBus block-transfer controller; this guest has none, `ipmi.ko` not loaded).

**Verification method:** line-by-line source trace of `sys/dev/misc/ipmi/ipmi_ssif.c`
(lines 77, 126, 128, 135, 143-144) + `sys/dev/misc/ipmi/ipmivars.h:46`. The bug is real.
See `VERDICT.md` for the full trace and `fix.diff` for the root-cause fix.

**Build/run:** there is no runtime PoC (no BMC ⇒ `ssif_polled_request()` is unreachable).
`build.sh` / `run.sh` document that the verification is source-trace + a combined fix-build
that compiled `ipmi_ssif.c` with `-Werror` rc=0 (`fix_build.log`).