# DF-2350 — PoC verdict

**File:** `sys/bus/u4b/uvc/uvc_drv.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

uvc_drv_parse_data reads dFrameInterval[i] in a loop bounded by attacker-controlled bFrameIntervalType without validating frmd->bLength is large enough to contain all declared intervals. usb_desc_foreach only guarantees desc+bLength<=end, not field accesses within bLength. A frame descriptor with bFrameIntervalType=255 but bLength=30 reads offsets 30..1042 past bLength, leaking kernel heap via itv->val exposed by VIDIOC_ENUM_FRAMEINTERVALS.

### Cited lines

- `sys/bus/u4b/uvc/uvc_drv.c:1915-1921`
- `sys/bus/u4b/uvc/uvc_drv.c:1946-1952`
- `sys/bus/u4b/uvc/uvc_drv.h:366-380`

## Why it does not reproduce on this guest

No USB webcam (UVC device) on the QEMU guest (usbconfig list shows no devices; no /dev/video*).

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Clamp frm->interval_type to (bLength - offsetof_of_dFrameInterval)/4 for both the frame and frame_based descriptors before the loop.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)