# DF-2407 VERDICT

**Status:** reproduced
**Impact:** panic
**Confidence:** certain

The len==0 signed/unsigned promotion in tpm_tis12_write walks *p unbounded past the 1024-byte buffer, proven three ways with production code: (1) capture cap=1024 consumes exactly 1024 bytes and the last byte is the 0xC3 buffer fill; (2) cap=1536 consumes 1536 bytes and the last byte is 0x00 kernel-stack residue past the buffer, delivered to the TPM DATA register (the vTPM exfil channel); (3) walk mode keeps TPM_STS_DATA_EXPECT asserted and the production loop reads sequentially until it hits the kernel stack guard page: panic vm_fault fault on stack guard inside tpm_tis12_write. Full production dev path also verified: write(fd, buf, 0) on a tpm_ops cdev dispatches production tpmwrite -> sc_start -> tpm_tis12_write(buf,0), consumed 1536 bytes, returned EIO, guest alive.

## Kernel references
- `sys/dev/crypto/tpm/tpm.c:807`
- `sys/dev/crypto/tpm/tpm.c:821`
- `sys/dev/crypto/tpm/tpm.c:823`
- `sys/dev/crypto/tpm/tpm.c:1181`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Notes
reachability: write(2) with count 0 is a legal call any root process can issue to a character device

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.