# DF-2025 PoC — Missing upper-bound on BMC-supplied response byte count

**Status:** `inconclusive` / reproduced=0 — **HW-GATED** (IPMI SSIF needs a BMC + ichsmb/
amdsmb block controller; none present, `ipmi.ko` not loaded).

**Verification method:** source trace of `sys/dev/misc/ipmi/ipmi_ssif.c:73,76,183,184,240-242`
+ `sys/bus/smbus/ichsmb/ichsmb.c:440-441,575` + `sys/bus/smbus/amdsmb/amdsmb.c:533-539`.
The `count` returned by `smbus_bread` is the raw BMC byte count (0..255), never clamped to
`SMBUS_DATA_SIZE`; the SSIF code then indexes the 32-byte stack `ssif_buf` with it ⇒ kernel
stack OOB read / info leak. See `VERDICT.md`, `fix.diff`.

**Build/run:** no runtime PoC (no BMC). `fix_build.log` proves `ipmi_ssif.c` compiled with
the fix under `-Werror` rc=0.