# DF-2410 — PoC verdict

**File:** `sys/dev/crypto/tpm/tpm_crb.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

tpmcrb_attach trusts four values read straight from TPM CRB registers (cmd_off, rsp_off, cmd_buf_size, rsp_buf_size) and never validates that each buffer+offset fits inside the allocated MMIO BAR; they are then used as BAR offsets in unbounded bus_write_region_stream_1/bus_read_region_stream_1 in tpmcrb_transmit.

### Cited lines

- `sys/dev/crypto/tpm/tpm_crb.c:188-196`
- `sys/dev/crypto/tpm/tpm_crb.c:367`
- `sys/dev/crypto/tpm/tpm_crb.c:385`

## Why it does not reproduce on this guest

No TPM (CRB or otherwise) on the QEMU guest (no /dev/tpm*; tpm_crb does not attach; the guest is booted without a TPM backend).

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

After reading the four register values, validate cmd_off+cmd_buf_size and rsp_off+rsp_buf_size each fit within rman_get_size(sc->mem_res); otherwise release the BAR and return ENXIO.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)