{
  "finding_id": "DF-2328",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED: with the same verbatim-ppbconf rig, a 256-byte NUL-free device ID ending in REVA (REV at offset 252, no colon anywhere) drives the REV branch search_token(&str[252], UNKNOWN_LENGTH, :) past str[255] into str[256] -- which ppb_1284_read_id never clears (it bzeros only max=256 of the 257-byte object, ppb_1284.c:595) -- and onward into adjacent stack: the walk finds no colon in the uninitialized/out-of-bounds bytes, returns NULL, and ppbconf.c:259 hands NULL+1 to kprintf: panic page fault in strlen() from kprintf (guest dies). The OOB walk itself is proven by construction: the delivered ID (console dump shows all 256 bytes, colon-free) contains no terminator and no colon, so every byte scanned past str[255] was uninitialized or out-of-bounds stack. The identical unchecked walk is the info-leak flavor whenever the crossed stack contains a colon (the bytes would be kprintf-ed to the console).",
  "exploit_chain": "256-byte NUL-free ID from malicious peripheral -> read_id clears only 256 of 257 bytes -> UNKNOWN_LENGTH scan leaves the object -> crosses uninitialized str[256] and stack (OOB read; console leak if a colon is crossed) -> NULL on colon-free stacks -> NULL+1 -> Fatal trap 12",
  "evidence": "run.log + panic.txt: console dump of the full 256-byte ID (A...REVA), the <unknown unknown. partial print, strlen/kprintf backtrace",
  "kernel_refs": [
    "sys/bus/ppbus/ppbconf.c:219",
    "sys/bus/ppbus/ppbconf.c:253",
    "sys/bus/ppbus/ppbconf.c:255",
    "sys/bus/ppbus/ppb_1284.c:589",
    "sys/bus/ppbus/ppb_1284.c:595",
    "sys/bus/ppbus/ppbconf.c:187"
  ],
  "poc_changes": "Same rig as DF-2327 (test=2); crafted ID generated in the worker.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Wed Oct 21 11:04:42 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/BUSAUDIT x86_64 (stock GENERIC + device targ; INVARIANTS)",
  "runtime_sec": 90,
  "guest_dirty": 1,
  "build_cmd": "cd b && make SYSDIR=/usr/src/sys",
  "run_cmd": "kldload ./ppbharness3.ko; sysctl hw.ppbx3.test=2",
  "code_hash": "8d751ea1371f93e32443422a6c40f77d1bfff3a7e3ea4ceefdcf32482bf4f5c4",
  "notes": "",
  "recommended_fix": "Force str[PPB_PnP_STRING_SIZE] = 0 before parsing (fix.diff); belt-and-braces with the DF-2327 guard.",
  "fix_status": "fixed",
  "fix_validation": "patched rig on the fix kernel: same ID parses to ppbus2: <unknown unknown. with no trap and no OOB walk"
}