# DF-2061 — PoC evidence pack

**Finding:** Unprivileged heap OOB read / wild MMIO read via HAL_DIAG_REGS
**Class:** Out-of-bounds read (CWE-125)  |  **Impact ceiling:** panic  |  **Confidence:** likely

## Status

SOURCE-CONFIRMED. The defect is verified real by line-by-line tracing of the
audited `sys/` tree, but it is **HW/module-gated**: the audit guest lacks the
required hardware/module (Atheros (ath) WLAN NIC present; reachability ungated only because of DF-2059), so it cannot be triggered at runtime
here. See `VERDICT.md` for the full mechanism and citations.

## How to reproduce (on a guest that HAS the hardware)

1. Ensure the gating precondition is met: Atheros (ath) WLAN NIC present; reachability ungated only because of DF-2059.
2. Apply `fix.diff` to confirm the cited path changes; before the fix the cited
   code path exhibits the behaviour described in `VERDICT.md`.
3. The original finding markdown describes the runtime trigger.

## Build validation (Phase 8)

`fix.diff` applies cleanly to pristine source. All nine findings' fixes were
built together; see `VERDICT.md` "Phase 8" and `fix_build.log`:

    make -j6 nativekernel KERNCONF=X86_64_GENERIC   # rc=0, -Werror, 0 warnings

## Files

- `VERDICT.md` — full narrative, mechanism, citations, fix-build result
- `fix.diff` — standalone `git apply`-able fix (authored post-verification)
- `fix_build.log` — full combined-fix kernel build output (rc=0, -Werror)
- `env.txt` — guest environment for this verification
- `manifest.json` — machine-readable catalog