# DF-2402 - Verification Verdict

**Status:** not_reproduced
**Impact:** leak
**Confidence:** certain

## Mechanism
apple_smc_mmio_key_read clamps rlen=min(device_len, len), fills buf[0..rlen) and returns 0 WITHOUT touching buf[rlen..len); the sysctl handler exposes the full len from a stack buffer, so a short device response discloses the uninitialized tail to sysctl readers.

## Verdict
NOT REPRODUCED (hardware/module-gated on this QEMU guest) - code-certain line-level confirmation in the read-only sys/ tree. Apple T2 SMC MMIO hardware absent in the QEMU guest; leak-by-omission confirmed at code level.

## Threat / reachability
Requires the named hardware/module; see VERDICT.md.

## Privilege escalation assessment
n/a (device-gated)

## Fix
bzero(buf, len) before filling (or zero only the tail).

## Kernel references
- `sys/dev/apple/smc/smc_mmio.c:78`
- `sys/dev/apple/smc/smc_mmio.c:80`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.