{
 "finding_id": "DF-2334",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "uaudio20_mixer_verify_desc (uaudio.c:3935-4086) verbatim rig: a UAC2 mixer descriptor with bLength == 5 + bNrInPins and a zero-length caller len passes both existing checks, and the read of d1->bNrChannels (uaudio.c:3988) lands one byte past the declared body - SIGSEGV at the guard page (si_addr == page boundary) in the crash scenario, and in the canary scenario the out-of-body byte (0x5A) demonstrably flows into the computed len (DPRINTF: len=8 of 104 bytes). With the added body check the guard scenario is rejected without any fault and the well-formed control is still accepted. Physical evil-USB exposure; descriptor is rejected after the read, so impact stays at the transient 1-byte OOB read (page-boundary panic possible in unlucky layouts).",
 "exploit_chain": "",
 "evidence": "run.log (guard: SIGSEGV si_addr=0x800474000; canary: OOB byte consumed into len; control ACCEPTED), run_fixed.log (guard rejected cleanly, no SIGSEGV), fix.diff",
 "kernel_refs": [
  "sys/bus/u4b/audio/uaudio.c:3986",
  "sys/bus/u4b/audio/uaudio.c:3988"
 ],
 "poc_changes": "initial caller len of 1 rejected the descriptor before the OOB; production caller passes 0 for degenerate clusters (ichs*ochs <= 7) so the rig uses len=0 for the attack shapes",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 180,
 "guest_dirty": 0,
 "build_cmd": "sh build.sh (userspace verbatim rig)",
 "run_cmd": "./run.sh  (guard canary control)",
 "code_hash": "0b418151e0fd22ba91dc7702f6fb5ff53542dd523706a1ac48f74a3c847d20a1",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "check bLength covers one more byte before reading d1->bNrChannels"
}