{
  "finding_id": "DF-2291",
  "title": "crom_parse_text bounds check missing sizeof(u_int32_t) multiplier allows OOB heap read past ROM buffer",
  "evidence_class": "verbatim-code rig (guest has no FireWire hardware/KLD; production dispatch impossible)",
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "leak",
  "confidence": "certain",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "production_parser_sha256": "b38ce9b52a249f594b4f11e0914eaa7fb6fbbccb0e174611d6a97f875f1466c5",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "BASELINE df2291_guard: OOB_FAULT_CONFIRMED (SIGSEGV at buffer_end+0, textleaf->text[3] at byte 1024); BASELINE df2291_canary: OOB_LEAK_CONFIRMED (output words c0ffee00..04 from bytes 1024..1043 land in the sdev->vendor-equivalent buffer); BASELINE control: PARSED_INBOUNDS; PATCHED both attack modes: NULLSTR_NO_FAULT (out=\"(null)\"); PATCHED control: PARSED_INBOUNDS"
  },
  "kernel_refs": [
    "sys/bus/firewire/fwcrom.c:207",
    "sys/bus/firewire/fwcrom.c:215-219",
    "sys/bus/firewire/fwcrom.c:459",
    "sys/bus/firewire/iec13213.h:148-159",
    "sys/bus/firewire/firewirereg.h:52-54",
    "sys/bus/firewire/firewire.c:1500",
    "sys/dev/disk/sbp/sbp.c:187",
    "sys/dev/disk/sbp/sbp.c:602-621",
    "sys/dev/disk/sbp/sbp.c:1527-1528"
  ],
  "artifacts": [
    "fwcrom_rig.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "run.2.log",
    "run.3.log",
    "fix.diff",
    "env.txt",
    "VERDICT.md",
    "README.md",
    "manifest.json",
    "verdict.json"
  ]
}