{
  "finding_id": "DF-2306",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "The REAL fwohci_pci_probe (verbatim TU rig) invoked with a fabricated generic-class 1394 OHCI identity (class 0x0c, subclass 0x00, progif 0x10, vendor/device 0x1a2b/0x3c4d not in the 25-entry hard-coded table) fell through to the class match at fwohci_pci.c:187-194 and unconditionally printed fwohci6: vendor=1a2b, dev=3c4d to the console via the unguarded device_printf at fwohci_pci.c:190-191, then set the description and returned 0. On real hardware this line is emitted on every boot for any OHCI controller absent from the ID table. Info severity confirmed: it discloses only semi-public hardware identifiers, but unconditionally and inconsistently with the specific-ID matches (which print nothing) and with the bootverbose/firewire_debug guards used elsewhere in the file (:261, :238). Fixed by hunk 1 of fix.diff (if (bootverbose) guard, sibling style); A/B validated on the fixed kernel: silent at bootverbose=0, prints at bootverbose=1, probe rc and description unchanged.",
  "exploit_chain": "",
  "evidence": "run.log: dmesg shows FWP: PROBE ... -> REAL fwohci_pci_probe followed by the stock console line fwohci6: vendor=1a2b, dev=3c4d and FWP: PROBE returned 0 desc=1394 Open Host Controller Interface. run_fixed.log: at bootverbose=0 no vendor line between the markers; at bootverbose=1 the line prints.",
  "kernel_refs": [
    "sys/bus/firewire/fwohci_pci.c:190-191",
    "sys/bus/firewire/fwohci_pci.c:187-194",
    "sys/bus/firewire/fwohci_pci.c:261-262",
    "sys/bus/firewire/fwohci_pci.c:238-243"
  ],
  "poc_changes": "Built on the new fwpci_harness.c rig (shared with DF-2304): fabricated PCI identity via the pci bus kobj BUS_READ_IVAR emulation, direct call of the verbatim static probe, plus a bootverbose toggle ioctl for the A/B.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #2: Sun Oct 18 14:03:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/FWO x86_64",
  "runtime_sec": 120,
  "guest_dirty": 1,
  "build_cmd": "sh /root/fwo/fwpci_prep.sh && sh /root/fwo/build_kernel.sh (nativekernel KERNCONF=FWO) ; cc -O -Wall -o fwpcictl fwpcictl.c",
  "run_cmd": "sh /root/fwo/run.sh  (fwpcictl probe 0x1a2b 0x3c4d 0x0c 0x00 0x10 as root)",
  "code_hash": "fe15a597dd10cab0a921f14900768d16933a756bac1fad238730ce4d93396ac5",
  "notes": "Guest has no 1394 hardware; the print targets the fabricated PCI identity through the byte-identical stock probe path. Severity Info: hardware fingerprinting only, no kernel-memory disclosure.",
  "recommended_fix": "Guard the device_printf at fwohci_pci.c:190 with if (bootverbose), matching the style at :261-262."
}