{
  "finding_id": "DF-2298",
  "title": "Heap OOB read/write via zero-length segment array from integer overflow in n",
  "file": "sys/bus/firewire/fwdma.c",
  "lines": [145, 160, 162, 163, 193],
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "memcorrupt: OOB-read-to-arbitrary-write (groom-chosen kernel address, fully attacker-chosen content/length via production fw_write uiomove); arbitrary-read mirror via fw_read; ungroomed variant = wild write/panic",
  "confidence": "certain",
  "reproduce": {
    "build": "guest, root, fresh `vm.sh reset with-src`: cd /root/df229x && sh build.sh  (compiles the unmodified production firewire.c+fwdma.c+fwdev.c into df229x.ko)",
    "run": "kldload ./df229x.ko; sysctl kern.df229x_test=2; sysctl kern.df229x_status   (groom fires only when the OOB read provably returns the planted pointer)",
    "expected": "df2298/a1: am (32-byte kmalloc, nseg=0) -> OOB am->seg[0].v_addr = <groom target> ...; fw_write err=0; victim page now \"\" / \"DF2298-OOB-WRITE\"; CONTROLLED WRITE CONFIRMED; kern.df229x_status 'DF-2298 REPRODUCED: ... OOB-read-to-arbitrary-write'. With fix.diff applied: 'STSTREAM err=22 (rejected, no write)'; regression test 5 still OK."
  },
  "kernel_refs": [
    "sys/bus/firewire/fwdma.c:145",
    "sys/bus/firewire/fwdma.c:157",
    "sys/bus/firewire/fwdma.c:160",
    "sys/bus/firewire/fwdma.c:162",
    "sys/bus/firewire/fwdma.c:163",
    "sys/bus/firewire/fwdma.c:193",
    "sys/bus/firewire/fwdma.h:51",
    "sys/bus/firewire/fwdma.h:59",
    "sys/bus/firewire/fwdma.h:65",
    "sys/bus/firewire/fwdev.c:103",
    "sys/bus/firewire/fwdev.c:107",
    "sys/bus/firewire/fwdev.c:108",
    "sys/bus/firewire/fwdev.c:109",
    "sys/bus/firewire/fwdev.c:116",
    "sys/bus/firewire/fwdev.c:388",
    "sys/bus/firewire/fwdev.c:390",
    "sys/bus/firewire/fwdev.c:391",
    "sys/bus/firewire/fwdev.c:504",
    "sys/bus/firewire/firewire.h:50"
  ],
  "artifacts": [
    "df229x.c", "Makefile", "shim/", "build.sh", "run_bootA.sh", "run_fix.sh",
    "run.log", "fix_run.log", "baseline_build.log", "fix_build.log", "env.txt",
    "fix.diff", "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}