# DF-2328 — missing NUL termination of the 257-byte PnP buffer enables OOB stack reads

## What (sys/bus/ppbus/ppbconf.c:219 + ppb_1284.c:595)
ppb_pnp_detect declares `char str[PPB_PnP_STRING_SIZE+1]` (257 bytes)
but ppb_1284_read_id bzeros only `max` = 256 bytes and never writes a
terminator; ppb_pnp_detect never executes str[len]=0.  With a 256-byte
NUL-free device ID, str[256] is uninitialized stack garbage and every
search_token(..., UNKNOWN_LENGTH, ...) scan walks past str[255] into
uninitialized and out-of-bounds stack (info leak of stack contents to
the console when a ':' is crossed; page fault when the walk returns
NULL and the caller computes NULL+1).

## Rig / Reproduce (same ppbharness3 rig, one boot)
    sysctl hw.ppbx3.test=2          # 256 'A's, "REV" at 252, no colon

## Result (run.log + panic.txt)
    ppb: <PnP> 256 characters: A ... A R E V A
    ppbus0: <unknown unknown.panic with 1 spinlocks held
    panic: page fault ... strlen() <- kprintf
The ID contains NO colon and NO NUL: the REV ':'-scan necessarily left
the object (crossing str[256] and the adjacent stack) before returning
NULL -> NULL+1 -> trap.  The same unchecked walk is the info leak
whenever the crossed stack bytes happen to contain ':'.

## Fix
fix.diff terminates str[PPB_PnP_STRING_SIZE] = '\0' before parsing.
Validated on the patched rig (VERDICT.md): no trap, clean parse.