{
 "finding_id": "DF-2321",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Unbounded CFTABLE_ENTRY extension loops confirmed by the verbatim pccard_cis.c parser rig (5-pack extractor, sha-gated): the power-parameter loop (pccard_cis.c:995-1003) and the misc-extension loop (:1243-1246) walk past the declared tuple body with no bound; with erased attribute memory (0xFF everywhere, bit 7 set) the walk never terminates - the scan exhausts a 4,000,000-read budget the kernel does not have, and the minimal-overwalk controls prove the bus read at idx == tuple->length happens before any check. With the two-line guard (abort_cfe when idx reaches tuple->length) the same shapes return normally with zero out-of-window reads. Hardware-gated (crafted PCMCIA CIS image at card insertion).",
 "exploit_chain": "",
 "evidence": "run.log (baseline: power_ext/misc_ext READ BUDGET EXHAUSTED exit 90; power_stops/misc_stops MARK lines prove read at idx==length), run_fixed.log (power_end/misc_end return normally, OOB: 0), extract_manifest.txt (PATCHED gate), fix.diff",
 "kernel_refs": [
  "sys/bus/pccard/pccard_cis.c:995",
  "sys/bus/pccard/pccard_cis.c:1243",
  "sys/bus/pccard/pccardvar.h:255"
 ],
 "poc_changes": "reused the DF-2319/2320 rig; added scenarios power_ext/misc_ext (0xFF tail), *_stops (planted terminator + MARK offset accounting), *_end (chained CISTPL_END for the fix A/B), ring-tail dump",
 "attempts": 5,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 900,
 "guest_dirty": 0,
 "build_cmd": "sh build.sh (userspace verbatim rig, extract.sh sha-gated)",
 "run_cmd": "./run.sh  (rig power_ext misc_ext power_stops misc_stops benign_cfe; fixed: power_end misc_end)",
 "code_hash": "fafb27c63524f338b15303cada81dd5adeeb0155ad799daa4655f439fb4e8e08",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "bound both CFTABLE_ENTRY extension loops with tuple->length checks (goto abort_cfe)"
}