{
  "finding_id": "DF-2325",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced mechanically on the stock INVARIANTS kernel: the verbatim pci_add_map/pci_mapsize driven with a fabricated 2 GiB BAR (sizing readback 0x80000000 -> ln2size 31) computed count=0xffffffff80000000 and end=0xffffffffbfffffff (sign-extended INT_MIN from the UB int shift at pci.c:2644/2650), versus the correct 0x80000000/0xbfffffff - exactly the inverted/garbage range the finding claims. Controls at ln2size 30 (1 GiB) and 16 (64 KiB) computed correctly, isolating the boundary. The shipped kernel CFLAGS (-O2 -fno-strict-overflow, no -fwrapv; cc 8.3) make the wrap deterministic in this build (cflags_evidence.txt) while remaining UB per C11 6.5.7p4. The REAL resource_list_add accepted the bogus range into the device resource list (realadd run), so the entry exists with a ~2^64 count; no memory corruption is claimed or needed - the practical impact is a permanently broken BAR reservation/mapping for 2 GiB-BAR devices (device malfunction, availability), hence impact recorded as none at the kernel memory-safety level with this note. Fix A/B validated: 1ULL shifts give the correct values at 31 with 16/30 bit-identical.",
  "exploit_chain": "",
  "evidence": "rig/bar_capture.log (stock kernel: bar 16/30 correct, bar 31 count=0xffffffff80000000 end=0xffffffffbfffffff, realadd accepts it), rig/fixed_runs.log (fixed: bar 31 count=0x80000000 end=0xbfffffff, controls unchanged), rig/cflags_evidence.txt (-fno-strict-overflow, no -fwrapv)",
  "kernel_refs": [
    "sys/bus/pci/pci.c:2644",
    "sys/bus/pci/pci.c:2650",
    "sys/bus/pci/pci.c:451",
    "sys/bus/pci/pcivar.h:48"
  ],
  "poc_changes": "verbatim pci_add_map + helpers via the shared DFPCI harness (see DF-2323 pack); BAR sizing probe answered by the interposed PCIB_WRITE/READ_CONFIG (write 0xffffffff -> next read returns the crafted mask), computed (start,end,count) captured at the interposed resource_list_add",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Sun Oct 18 18:36:44 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/DFPCI x86_64 (baseline); fixed runs on DFPCIPF #0 Sun Oct 18 19:54:35 UTC 2026",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "sh rig/build.sh DFPCI (shared harness with DF-2323)",
  "run_cmd": "vm.sh run_root \"sysctl debug.dfpcih.cmd=bar_31\" (bar 16, bar 30, bar 31, bar 31 realadd); rig/run_2325.sh",
  "code_hash": "ce238fc92dcbe657b33d6084dfbc60caa3ace94d56814d639d95ec5c0582105e",
  "notes": "impact none = no kernel memory-safety effect demonstrated or claimed; the demonstrated effect is deterministic mis-sizing of 2 GiB BARs (broken reservation, device malfunction). severity stays Low per the finding. no DB writes by reviewer",
  "recommended_fix": "use 1ULL << ln2size in both the count and end computations of pci_add_map"
}