# DF-2071 PoC — kbdsw dispatch shims skip the kb_index bounds/NULL check

## Status: VERIFIED (source-only) + FIX VALIDATED

Only `kbd_intr` (`kbdsw.c:103`) validates `kbd->kb_index` before
indexing `kbdsw[]`. The other 16 dispatch shims deref
`kbdsw[kbd->kb_index]` raw — unsafe if a caller hands in a stale
`keyboard_t *` whose slot was unregistered (`kbdsw[i] = NULL` in
`kbd.c:282`) or whose `kb_index` is corrupt.

Latent: `kb_index` is not attacker-controllable through any in-tree
unprivileged path (the cdev entry points re-validate under `kbd_token`).
Needs a separate primitive to manifest (NULL-deref panic).

See `VERDICT.md` for the full 16-site table and fix validation.

## Reproduce

```
./build.sh   # rebuilds the patched kernel (rc=0 with -Werror)
./run.sh     # source-only confirmation; no runtime PoC (latent)
```

## Fix

`fix.diff` adds a `kbdsw_index_valid(int i)` helper mirroring the
`kbd_intr` guard and inserts a check at all 16 dispatch sites (return
value matches each function's return type).