{
 "finding_id": "DF-2403",
 "verdict": "reproduced",
 "impact": "leak",
 "reproduce": {
  "build": "see build.sh (dfhw.ko kld rig: verbatim apple_smc.ko symbols + fabricated softc/bus)",
  "run": "sysctl dev.dfsm.0.spray; sysctl dev.dfsm.0.fanid  (as user nobody)",
  "expected": "Uninitialized kernel-stack disclosure via the production apple_smc_mb_sysctl_fanid handler, read as unprivileged user nobody through a fabricated MMIO/T2 backend reporting the documented 8-byte F0ID p"
 },
 "kernel_refs": [
  "sys/dev/apple/smc/smc_sysctl.c:51",
  "sys/dev/apple/smc/smc_sysctl.c:56",
  "sys/dev/apple/smc/smc_sysctl.c:61",
  "sys/dev/apple/smc/smc_io.c:436",
  "sys/dev/apple/smc/smc_mmio.c:74"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "build.sh",
  "dfhw.c",
  "env.txt",
  "fix.diff",
  "manifest.json",
  "run.log",
  "run.sh",
  "smcleak.c",
  "smcvar.c",
  "verdict.json"
 ]
}