{
  "finding_id": "DF-2290",
  "title": "Unchecked info_len in crom_init_context enables OOB heap reads up to ~1000 bytes past csrrom[] buffer",
  "evidence_class": "verbatim-code rig (guest has no FireWire hardware/KLD; production dispatch impossible)",
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "leak",
  "confidence": "certain",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "production_parser_sha256": "b38ce9b52a249f594b4f11e0914eaa7fb6fbbccb0e174611d6a97f875f1466c5",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "BASELINE df2290_guard: OOB_FAULT_CONFIRMED (SIGSEGV at buffer_end+3, root entry[0] quadlet [1024,1028) fully OOB); BASELINE df2290_canary: OOB_LEAK_CONFIRMED (reg at buffer+1052, reg->val=0x00C0FFEE sourced from past the buffer); BASELINE control: PARSED_INBOUNDS; PATCHED both attack modes: REJECTED_NO_FAULT; PATCHED control: PARSED_INBOUNDS"
  },
  "kernel_refs": [
    "sys/bus/firewire/fwcrom.c:60",
    "sys/bus/firewire/fwcrom.c:84",
    "sys/bus/firewire/fwcrom.c:102",
    "sys/bus/firewire/fwcrom.c:130-131",
    "sys/bus/firewire/iec13213.h:133-147",
    "sys/bus/firewire/firewirereg.h:52-54",
    "sys/bus/firewire/firewire.c:1311",
    "sys/bus/firewire/firewire.c:1496-1500",
    "sys/dev/disk/sbp/sbp.c:412",
    "sys/dev/disk/sbp/sbp.c:602-621"
  ],
  "artifacts": [
    "fwcrom_rig.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "run.2.log",
    "run.3.log",
    "fix.diff",
    "env.txt",
    "VERDICT.md",
    "README.md",
    "manifest.json",
    "verdict.json"
  ]
}