{ "finding_id": "DF-2328", "status": "reproduced", "reproduced": 1, "impact": "panic", "confidence": "certain", "verdict": "REPRODUCED: with the same verbatim-ppbconf rig, a 256-byte NUL-free device ID ending in REVA (REV at offset 252, no colon anywhere) drives the REV branch search_token(&str[252], UNKNOWN_LENGTH, :) past str[255] into str[256] -- which ppb_1284_read_id never clears (it bzeros only max=256 of the 257-byte object, ppb_1284.c:595) -- and onward into adjacent stack: the walk finds no colon in the uninitialized/out-of-bounds bytes, returns NULL, and ppbconf.c:259 hands NULL+1 to kprintf: panic page fault in strlen() from kprintf (guest dies). The OOB walk itself is proven by construction: the delivered ID (console dump shows all 256 bytes, colon-free) contains no terminator and no colon, so every byte scanned past str[255] was uninitialized or out-of-bounds stack. The identical unchecked walk is the info-leak flavor whenever the crossed stack contains a colon (the bytes would be kprintf-ed to the console).", "exploit_chain": "256-byte NUL-free ID from malicious peripheral -> read_id clears only 256 of 257 bytes -> UNKNOWN_LENGTH scan leaves the object -> crosses uninitialized str[256] and stack (OOB read; console leak if a colon is crossed) -> NULL on colon-free stacks -> NULL+1 -> Fatal trap 12", "evidence": "run.log + panic.txt: console dump of the full 256-byte ID (A...REVA), the