# DF-2331 — PoC verdict

**File:** `sys/bus/smbus/ichsmb/ichsmb.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

The ichsmb block-read interrupt handler trusts the 8-bit count byte read from the ICH_D0 hardware register (slave-supplied, 0..255) to bound a store loop into the fixed-size sc->block_data[32] array. count>32 writes up to 224 bytes past block_data.

### Cited lines

- `sys/bus/smbus/ichsmb/ichsmb.c:575-597`
- `sys/bus/smbus/ichsmb/ichsmb_var.h:64`

## Why it does not reproduce on this guest

No Intel ICH SMBus controller / SMBus slave on the QEMU guest (PIIX3 0x7113 is reported as "none0", ichsmb does not attach; no /dev/smbus*).

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

After reading block_count from ICH_D0, clamp it to nitems(sc->block_data) (32).

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)