{
 "finding_id": "DF-2295",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "fw_read copies fp->mode.stream.len+4 bytes from a psize-sized DMA packet slot with no bound (fwdev.c:329-330). With psize=512 and a peer-supplied stream.len=1500, read() returned 1504 bytes successfully, 992 bytes beyond the slot, and every beyond-slot byte was attributed to known adjacent ring-slot content (62/62 canary windows decode to the exact slot+offset). Requires an operator-group opener plus a malicious FireWire peer supplying the oversized header; disclosure covers the whole DMA ring and, for extreme len, memory past the ring allocation (same primitive; beyond-ring variant not separately run). Fix validated: clamping the copy to ir->psize keeps a legit packet (len 508) bit-identical and bounds every copy to one slot.",
 "exploit_chain": "operator-group user sets up iso receive (SSTBUF/SRSTREAM); malicious peer injects stream packet with len>psize-4; user read() receives adjacent kernel DMA-heap bytes (proof: full byte attribution). Read-only disclosure; no write primitive; no direct privesc - flagged as leak with peer-cooperation precondition.",
 "evidence": "leak_sample.txt (1504-byte read dump), leak_attributed.txt (62/62 windows attributed host-side), run_2295_baseline.log, leak_legit_508.txt vs leak_fixed_508.txt (bit-identical diff), run_2295_fixed_malicious.log",
 "kernel_refs": [
  "sys/bus/firewire/fwdev.c:319",
  "sys/bus/firewire/fwdev.c:321",
  "sys/bus/firewire/fwdev.c:325",
  "sys/bus/firewire/fwdev.c:329",
  "sys/bus/firewire/fwdev.c:330",
  "sys/bus/firewire/fwdev.c:339",
  "sys/bus/firewire/fwdma.h:59"
 ],
 "poc_changes": "Rewrote as a coordinated reader/injector: opuser opens/reads, root-side fwhctl emulates the OHCI receive DMA (canary ring + crafted header through the real fwdma_v_addr slot). Fixed a stdout-buffering race and an attribution counter bug (bytes vs words) in the pack copy.",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #8: Sun Oct 18 07:38:56 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/FWH  x86_64",
 "runtime_sec": 1200,
 "guest_dirty": 0,
 "build_cmd": "cd findings/poc/DF-2295 && sh build.sh",
 "run_cmd": "sh run.sh (guest; root injects during the READY window)",
 "code_hash": "d13f1ff3e1b349307510e57fe6530892759fa686e0fc1d787815d47a2d362f40",
 "notes": "Verified in VERIFY mode via the verbatim-interposition kernel harness (fwharness.c): stock fwdev.o/fwdma.o/firewire.o binaries, fabricated controller externalities, /dev/fw0.0 created against the real firewire_ops with stock 0660 root:operator clone perms. Guest has no FireWire hardware and stock GENERIC ships firewire without fwohci, so no /dev/fw node exists without hardware or a kld - reachability quantified per finding. Fix A/B on the same harness kernel: bug inputs return clean errors, legit inputs bit-identical/unchanged. Guest reset to clean-source snapshot after the run.",
 "recommended_fix": "Clamp the uiomove length to ir->psize (ulen = min(stream.len+4, ir->psize)).",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #8: Sun Oct 18 07:38:56 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/FWH  x86_64"
}