{
 "finding_id": "DF-2330",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "amdsmb_bread (amdsmb.c:517-547) verbatim rig with an emulated AMD-8111 SMBus controller: a non-compliant slave reporting BCNT=255 makes the loop fetch logical SMB registers 0x04..0xff via the EC protocol - 221 fetches beyond the 32-entry data register file (SMB_DATA..0x23), sweeping protocol registers after the u_char offset wraps - and sets *count=255 against a 32-byte caller buffer (contract break: caller reads 223 uninitialized bytes). With the 32 clamp the attack run is indistinguishable from the compliant control (count_out=32, only the legitimate BCNT fetch touches >0x23). Hardware-gated twice over: AMD-8111 SMBus2 controller plus a malicious slave, via root-only /dev/smbN.",
 "exploit_chain": "",
 "evidence": "run.log (attack: PROOF + CONTRACT BREAK lines; edge bcnt=33; control), run_fixed.log (count_out=32, OOB=1 legitimate BCNT fetch), fix.diff",
 "kernel_refs": [
  "sys/bus/smbus/amdsmb/amdsmb.c:533",
  "sys/bus/smbus/amdsmb/amdsmb.c:534",
  "sys/bus/smbus/amdsmb/amdsmb.c:539"
 ],
 "poc_changes": "first model returned 224 (rig had overwritten the BCNT register in its own data fill); fixed the model to serve distinct values beyond the file",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "build_cmd": "sh build.sh (userspace verbatim rig)",
 "run_cmd": "./run.sh  (attack edge control)",
 "code_hash": "dfdbaafd5b4966ce979deca4c1d67b7a003b2de0f2b3490989e89c41c158fa9f",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "clamp the hardware byte count to the 32-entry data register file in amdsmb_bread"
}