{
 "finding_id": "DF-2294",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "FW_SBINDADDR dereferences ir->dmach (fwdev.c:617) and FW_CBINDADDR dereferences &ir->binds (fwdev.c:600) while d->ir is NULL (no FW_SRSTREAM yet). Both reproduced on the stock fwdev.o binary: Fatal trap 12 page faults at exactly 0x10 (offsetof fw_xferq,dmach) for the single-open single-ioctl SBINDADDR case and 0x38 (offsetof fw_xferq,binds) for the two-fd CBINDADDR case (bind registered on fd1 via real fw_bindadd, CBINDADDR issued from fd2 with NULL d->ir). Operator-group user; no bus activity. Fix validated: NULL guards return EINVAL on both paths with the legitimate bind path intact.",
 "exploit_chain": "open /dev/fw0.0 + FW_SBINDADDR -> kernel panic (DoS). CBINDADDR needs a second fd on the same controller after a legit bind exists. No escalation: NULL-offset fault only.",
 "evidence": "panic.sbindaddr.txt (fault va 0x10, fw_ioctl+0x6eb), panic.cbindaddr.txt (fault va 0x38, fw_ioctl+0x429), run_fixed.log (EINVAL both, legit bind path still works)",
 "kernel_refs": [
  "sys/bus/firewire/fwdev.c:443",
  "sys/bus/firewire/fwdev.c:592",
  "sys/bus/firewire/fwdev.c:600",
  "sys/bus/firewire/fwdev.c:603",
  "sys/bus/firewire/fwdev.c:617"
 ],
 "poc_changes": "Seed concept kept; added the honest two-fd CBINDADDR reproducer (a matching bind must exist for fw_bindlookup to succeed before the NULL deref is reached); fd2 uses /dev/fw0.1 like the stock fwdev_clone per-stream minors.",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #8: Sun Oct 18 07:38:56 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/FWH  x86_64",
 "runtime_sec": 900,
 "guest_dirty": 0,
 "build_cmd": "cd findings/poc/DF-2294 && sh build.sh",
 "run_cmd": "sh run.sh (guest; capture serial console for panic)",
 "code_hash": "8849f3a558ef0387171c9bdeafb07ec04525e7ccf082a1d7079cd1f626b54610",
 "notes": "Verified in VERIFY mode via the verbatim-interposition kernel harness (fwharness.c): stock fwdev.o/fwdma.o/firewire.o binaries, fabricated controller externalities, /dev/fw0.0 created against the real firewire_ops with stock 0660 root:operator clone perms. Guest has no FireWire hardware and stock GENERIC ships firewire without fwohci, so no /dev/fw node exists without hardware or a kld - reachability quantified per finding. Fix A/B on the same harness kernel: bug inputs return clean errors, legit inputs bit-identical/unchanged. Guest reset to clean-source snapshot after the run.",
 "recommended_fix": "NULL-check d->ir (ir == NULL -> EINVAL) at the top of FW_SBINDADDR and FW_CBINDADDR.",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #8: Sun Oct 18 07:38:56 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/FWH  x86_64"
}