{
  "finding_id": "DF-2312",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED in both flavors on the production iic.ko rig: (A) nmsgs=262144 makes the kernel really perform the unvalidated kmalloc(4 MiB) + kmalloc(2 MiB) pair in one ioctl (vmstat temp +2 MiB retained usrbufs per call via the DF-2309 interaction; the msgs copyin then EFAULTs); (B) nmsgs=134217728 drives kmalloc(2147483648) (2 GiB) straight into panic: temp: malloc limit exceeded, backtrace malloc <- _kmalloc <- iicioctl <- dev_dioctl. A single unvalidated u32 multiplied into M_WAITOK sizes is a one-syscall privileged kernel panic; moderate values silently allocate without bound.",
  "exploit_chain": "",
  "evidence": "run.log + panic.txt: phase A allocation accounting; phase B panic: temp: malloc limit exceeded with iicioctl in the backtrace",
  "kernel_refs": [
    "sys/bus/iicbus/iic.c:350",
    "sys/bus/iicbus/iic.c:351",
    "sys/bus/iicbus/iic.c:352",
    "sys/kern/kern_slaballoc.c:877"
  ],
  "poc_changes": "Self-contained iic ABI header (no /usr/include/bus/iicbus on the guest).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Wed Oct 21 11:04:42 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/BUSAUDIT x86_64 (stock GENERIC + device targ; INVARIANTS)",
  "runtime_sec": 60,
  "guest_dirty": 1,
  "build_cmd": "cc -O -Wall -o poc2312 poc2312.c",
  "run_cmd": "./poc2312 A   then   ./poc2312 B (separate run; panics)",
  "code_hash": "e0d8c94fd15c08f728cdbc91d4acf9dbae8d0ea6f2954ca32edacfa3ee5d4761",
  "notes": "",
  "recommended_fix": "Reject nmsgs == 0 || nmsgs > 4096 with EINVAL before the allocations (fix.diff).",
  "fix_status": "fixed",
  "fix_validation": "fix kernel + rebuilt iic.ko: phase A and phase B both return EINVAL instantly, no allocation, no panic, guest stays up"
}