# DF-2445 - Verification Verdict

**Status:** reproduced
**Impact:** leak
**Confidence:** certain

## Mechanism
dm_dev_alloc copies the caller-supplied uuid with strncpy(dmv->uuid, uuid, sizeof(dmv->uuid)) where sizeof==DM_UUID_LEN==129, with no guaranteed NUL. A prop-dictionary uuid of >=129 chars leaves dmv->uuid unterminated; every later %s/strcmp/prop_dictionary_set_cstring consumer walks past the array until an unrelated zero byte (currently the struct padding before cdev_t devt).

## Verdict
REPRODUCED as root on the stock guest (kldload dm): DM create with a 130-char uuid succeeds, and the info ioctl reads back a 129-CHAR uuid - one byte more than the 128-char maximum a NUL-terminated uuid[129] store could ever return. The kernel-side prop_dictionary_set_cstring(DM_IOCTL_UUID, dmv->uuid) at dm_ioctl.c:414 performed the over-read to build that string. Termination today depends on unrelated struct padding; any field reordering or an all-non-zero neighbor turns this into a longer heap over-read into the status reply (root/operator-gated surface).

## Threat / reachability
dm ioctls are root/operator gated (control dev 0640); impact is a latent heap over-read disclosed to the same privileged caller - hygiene, plus correctness for uuid-based lookup (strcmp over-read).

## Privilege escalation assessment
n/a (privileged-only surface; no unprivileged path to /dev/mapper/control)

## Fix
strlcpy instead of strncpy (name already uses strlcpy two lines above).

## Kernel references
- `sys/dev/disk/dm/dm_dev.c:367`
- `sys/dev/disk/dm/dm.h:66`
- `sys/dev/disk/dm/dm_ioctl.c:414`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.