{
 "finding_id": "DF-2407",
 "verdict": "reproduced",
 "impact": "panic",
 "reproduce": {
  "build": "see build.sh (dfhw.ko + tpm.ko)",
  "run": "sysctl \"kern.dfhwgo=tis 1536\"; sysctl \"kern.dfhwgo=tis 0 walk\"; /root/tpm0 /dev/dfhtis0",
  "expected": "The len==0 signed/unsigned promotion in tpm_tis12_write walks *p unbounded past the 1024-byte buffer, proven three ways with production code: (1) capture cap=1024 consumes exactly 1024 bytes and the l"
 },
 "kernel_refs": [
  "sys/dev/crypto/tpm/tpm.c:807",
  "sys/dev/crypto/tpm/tpm.c:821",
  "sys/dev/crypto/tpm/tpm.c:823",
  "sys/dev/crypto/tpm/tpm.c:1181"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "build.sh",
  "dfhw.c",
  "env.txt",
  "fix.diff",
  "manifest.json",
  "panic.txt",
  "run.sh",
  "tpm0.c",
  "verdict.json"
 ]
}