# DF-2234 — PoC evidence pack

**Finding:** `iconv_add()`/`iconv_register_cspair()` accept unbounded charset
names; `iconv_sysctl_cslist()` `strcpy` overflows the 31-byte on-stack fields
(`sys/libiconv/iconv.c:368-369`; no bound at :179-216).
**Verdict:** REPRODUCED — kernel stack buffer overflow: unprivileged read of
`kern.iconv.cslist` panics with RBP = 0x4242424242424242 after a KLD
registered 200-char names via the exported `iconv_add()`. Registration of
over-long names is root-gated on this tree (kern_sysctl.c:1447), so impact =
privileged-arm / unprivileged-trigger DoS (latent memory-corruption hazard),
not unpriv privesc. See `VERDICT.md`, `panic.txt`, `run.log`.

## Build

Guest (root): `sh build.sh` → `/root/rig2234/longcs.ko`, `csread`, `addtest`
(copies of the userland tools are placed in /home/maxx for the unpriv runs).

## Run (baseline — expect Fatal trap 9)

    sh run.sh                       # on the guest, as root
    # host: dfbsd-qemu/vm.sh log

Expected decisive output (see panic.txt):

    Fatal trap 9: general protection fault while in kernel mode
    frame pointer  = 0x10:0x4242424242424242
    Stopped at      iconv_sysctl_cslist+0xf7:  ret

## Fix validation

    cd /usr/src && patch -p1 < fix.diff
    (rebuild a libiconv module from the patched tree; kldload it instead of stock)
    kldload /root/rig2234/longcs.ko   -> "iconv_add failed: 22" (rejected)
    addtest 30 / addtest 31           -> ok / EINVAL (unchanged)
    su maxx -c /home/maxx/csread      -> clean, bit-identical control listing

## Files

    Makefile           kmod makefile for longcs.ko
    longcs.c           trigger KLD: iconv_add() with 200-char to/from names
    csread.c           unprivileged kern.iconv.cslist reader (+ dump)
    addtest.c          kern.iconv.add boundary prober (30 vs 31 chars)
    build.sh, run.sh   exact commands
    build.log          full module build output
    run.log            full run narrative + outputs (baseline + fix A/B)
    panic.txt          serial console panic capture
    env.txt            guest environment
    fix.diff           validated fix (registration bound + strlcpy)
    manifest.json      machine catalog
    verdict.json       machine verdict