{
 "finding_id": "DF-2293",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Zero bufreq.psize (no FW_SSTBUF before FW_SRSTREAM/FW_STSTREAM) reaches fwdma_malloc_multiseg with esize=0 and panics on rounddown(PAGE_SIZE, 0) integer division by zero. Reproduced twice as an operator-group user through the stock fwdev.o and fwdma.o binaries: Fatal trap 18 with backtraces fwdma_malloc_multiseg+0x139 <- fwdev_allocbuf+0x6a <- fw_ioctl+0x94e (SRSTREAM) and +0x982 (STSTREAM). Two syscalls, no bus activity. Fix validated: bufspec validation returns EINVAL, no panic, legit allocation path unchanged.",
 "exploit_chain": "open /dev/fw0.0 (0660 root:operator) + one FW_SRSTREAM or FW_STSTREAM ioctl with zeroed bufreq -> kernel panic (DoS). No escalation: divide trap only.",
 "evidence": "panic.srstream.txt and panic.ststream.txt (trap 18 backtraces at the two fw_ioctl call sites), run_fixed.log (EINVAL on patched kernel, guest alive), VERDICT.md",
 "kernel_refs": [
  "sys/bus/firewire/fwdev.c:179",
  "sys/bus/firewire/fwdev.c:94",
  "sys/bus/firewire/fwdev.c:107",
  "sys/bus/firewire/fwdev.c:108",
  "sys/bus/firewire/fwdev.c:447",
  "sys/bus/firewire/fwdev.c:458",
  "sys/bus/firewire/fwdev.c:475",
  "sys/bus/firewire/fwdev.c:486",
  "sys/bus/firewire/fwdma.c:145",
  "sys/bus/firewire/fwdma.c:159",
  "sys/sys/param.h:400"
 ],
 "poc_changes": "Seed concept kept; trigger built self-contained (embedded ioctl structs with _Static_assert layout checks); ran as operator-group user opuser on the fabricated /dev/fw0.0 with stock clone permissions.",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #8: Sun Oct 18 07:38:56 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/FWH  x86_64",
 "runtime_sec": 900,
 "guest_dirty": 0,
 "build_cmd": "cd findings/poc/DF-2293 && sh build.sh",
 "run_cmd": "sh run.sh  (guest; capture serial console for panic)",
 "code_hash": "7a5960f799a6514d6597a2c3365853c0f825fb9980deb01e7d479bc0180f164a",
 "notes": "Verified in VERIFY mode via the verbatim-interposition kernel harness (fwharness.c): stock fwdev.o/fwdma.o/firewire.o binaries, fabricated controller externalities, /dev/fw0.0 created against the real firewire_ops with stock 0660 root:operator clone perms. Guest has no FireWire hardware and stock GENERIC ships firewire without fwohci, so no /dev/fw node exists without hardware or a kld - reachability quantified per finding. Fix A/B on the same harness kernel: bug inputs return clean errors, legit inputs bit-identical/unchanged. Guest reset to clean-source snapshot after the run.",
 "recommended_fix": "Validate psize/nchunk/npacket > 0 in fwdev_allocbuf before any allocation.",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #8: Sun Oct 18 07:38:56 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/FWH  x86_64"
}