DF-2328 missing-NUL OOB-walk panic (BUSAUDIT kernel, fresh boot, test=2)
====================================================================
# kldload ppbharness3.ko; sysctl hw.ppbx3.test=2
console:
PPBX3: arming DF-2328 (256B NUL-free ID, REV at 252, no colon) attach NOW
ppbus0: <Parallel port bus> on ppc0.
ppb: <PnP> 256 characters: A(0x41) ... A(0x41) R(0x52) E(0x45) V(0x56) A(0x41)
ppbus0: <unknown unknown.panic with 1 spinlocks held
panic: page fault.
--- trap 000000000000000c, rip = ffffffff809d8f70 ... ---
strlen() at strlen
kprintf() at kprintf+0x73
<dump>

Mechanism: ppb_1284_read_id (ppb_1284.c:595) bzeros only 256 of the 257
bytes of str[]; the delivered ID is 256 non-NUL bytes ending "...REVA";
the MFG/MDL lookups fail in-bounds ("<unknown unknown" printed), then the
REV branch runs search_token(&str[252], UNKNOWN_LENGTH, ":") which walks
str[252..255] -> str[256] (UNINITIALIZED) -> adjacent stack (OOB read),
finds no ':' -> NULL -> +1 -> strlen(0x1) -> Fatal trap 12.  The panic is
reachable ONLY because the scan left the object: the delivered ID is
colon-free and NUL-free, so every byte the scan crossed past str[255] was
uninitialized/OOB stack memory (had the walk crossed a ':' in that stack
garbage, kprintf would have printed the stack bytes to the console
instead -- the info-leak flavor of the same defect).