{
  "finding_id": "DF-2327",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED: on the ppbharness3 rig (verbatim production ppbconf.c/ppb_1284.c/ppb_base.c compiled into a KLD, sha256 recorded, driven by a scripted malicious IEEE1284 peer -- no parallel port exists in QEMU), the crafted device ID MFG;MFG (semicolon replaced by NUL at ppbconf.c:236-237, leaving MFG\\0MFG\\0 with no colon anywhere) makes search_token(str,len,MFG) match at 0 and search_token(str,UNKNOWN_LENGTH,:) return NULL; ppbconf.c:242 computes NULL+1 and kprintf(ppbus0: <%s, (char*)0x1) faults: panic page fault in strlen() from kprintf, guest dies in the dump. The console shows the exact 7-character ID delivered and the partial < print before the trap. Attack vector AV:P (malicious parallel-port peripheral; automatic boot/rescan probing).",
  "exploit_chain": "malicious IEEE1284 peripheral returns MFG;MFG device ID -> ppb_pnp_detect NUL-fragments the string -> colon search returns NULL -> NULL+1 to kprintf %s -> Fatal trap 12 (kernel panic at probe time)",
  "evidence": "run.log + panic.txt: console shows the crafted ID bytes, the partial print, and the strlen/kprintf backtrace; build log records the verbatim-source sha256s",
  "kernel_refs": [
    "sys/bus/ppbus/ppbconf.c:236",
    "sys/bus/ppbus/ppbconf.c:239",
    "sys/bus/ppbus/ppbconf.c:242",
    "sys/bus/ppbus/ppbconf.c:249",
    "sys/bus/ppbus/ppbconf.c:255",
    "sys/bus/ppbus/ppbconf.c:259",
    "sys/bus/ppbus/ppbconf.c:264",
    "sys/bus/ppbus/ppbconf.c:271"
  ],
  "poc_changes": "Authored the ppbharness3 rig (DF-5510 family) with sysctl-armed per-boot tests (panics need one boot each); first test=3 attempt crashed in my own worker (BUS_ADD_CHILD on an unattached ppbus) -- fixed by attaching with a benign ID first; fresh ppbus child per panic test added later so both crafted IDs probe for real.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Wed Oct 21 11:04:42 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/BUSAUDIT x86_64 (stock GENERIC + device targ; INVARIANTS)",
  "runtime_sec": 120,
  "guest_dirty": 1,
  "build_cmd": "cd b && make SYSDIR=/usr/src/sys (verbatim ppbus sources + ppbharness3.c)",
  "run_cmd": "kldload ./ppbharness3.ko; sysctl hw.ppbx3.test=1",
  "code_hash": "8d751ea1371f93e32443422a6c40f77d1bfff3a7e3ea4ceefdcf32482bf4f5c4",
  "notes": "",
  "recommended_fix": "NULL-safe ppb_pnp_field() helper for all six colon-search sites (fix.diff).",
  "fix_status": "fixed",
  "fix_validation": "patched rig on the fix kernel: same crafted ID parses to ppbus1: < unknown> and the attach completes with NO trap (fresh-child harness, same boot)"
}