{
 "finding_id": "DF-2342",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "uchcom_read_reg/uchcom_get_version (uchcom.c:413-442) verbatim rig: the shimmed ucom_cfg_do_request models a CH341 that completes the 8-byte vendor read with zero (or one) data bytes and returns success; the verbatim consumers read buf[0]/buf[1] unconditionally. With a poisoned kernel stack (0xA5) the debug print shows the raw uninitialized bytes (0x06->0xA5, 0x07->0xA5), and uchcom_convert_status maps ~buf[0]&0x0F into the four TIOCMGET-visible modem-status bits (sc_msr=0xaa: nibble 0xA is pure poison). The 1-byte variant leaks the second byte via the XOR path. With the bzero both channels carry deterministic zeros. Requires a malicious CH341 device; dmesg print needs a USB_DEBUG kernel, the TIOCMGET nibble does not.",
 "exploit_chain": "malicious CH341 returns short/zero-length control responses; any TIOCMGET poll on the open tty reads 4 bits of kernel stack per call; 2 raw bytes per poll on USB_DEBUG builds",
 "evidence": "run.log (zerolen/short1: DPRINTF poison bytes + sc_msr nibbles), run_fixed.log (0x06->0x00 deterministic), fix.diff",
 "kernel_refs": [
  "sys/bus/u4b/serial/uchcom.c:417",
  "sys/bus/u4b/serial/uchcom.c:427",
  "sys/bus/u4b/serial/uchcom.c:480",
  "sys/bus/u4b/serial/uchcom.c:597"
 ],
 "poc_changes": "wValue/wIndex/wLength shimmed as 2-byte arrays so the verbatim USETW macro text compiles; ucom sc_parent wired so uchcom_cfg_get_status runs verbatim",
 "attempts": 5,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 180,
 "guest_dirty": 0,
 "build_cmd": "sh build.sh (userspace verbatim rig)",
 "run_cmd": "./run.sh  (zerolen short1 control)",
 "code_hash": "7bfcac9f16682367fd1e9606973ba7715781bfd3c9588e2753fe743172225093",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "bzero the response buffers before the control request"
}