# DF-2430 VERDICT

**Status:** reproduced
**Impact:** none
**Confidence:** likely

Source-level harness (DF-1510 precedent) of the exact Inquire-Model parse loop (bt.c:420-425, byte-identical semantics) proves the off-by-one: with the documented 5-byte reply whose fifth byte is 0x00 (not space), the loop exits with i==5 and bt->model[5] = 0 writes one byte past char model[5], the LAST field of struct bt_softc (btreg.h:638) - the trailing canary flipped 0x42 -> 0x00. The full production bt_fetch_adapter_info dispatch was attempted through a watchpoint-emulated BusLogic port protocol but the command handshake could not be completed reliably on this snapshot, so the demonstration is harness-level; code-level truth is certain (sizeof(bt_softc)=344, terminator lands at +344).

## Kernel references
- `sys/dev/disk/buslogic/bt.c:420`
- `sys/dev/disk/buslogic/bt.c:425`
- `sys/dev/disk/buslogic/btreg.h:638`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Notes
impact depends on slab size-class rounding for 344 bytes; single NUL byte, Low

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.