# DF-2525 verdict -- trm_check_eeprom ILP32 u_long stores overflow the 128-byte NVRAM struct on x86_64

status: reproduced   reproduced: 1   impact: limited_write
confidence: certain   attempts: 1   runtime_sec: 500

The verbatim trm_check_eeprom default-load writes u_long (8 bytes on x86_64) per store into a schema of 4-byte NVRAMTARGETTYPE words: 16 + 2 + 12 stores starting at &NvramTarget (offset 10) span offsets 10..257 of a 128-byte NVRAMTYPE. With a failed checksum the verbatim function smashed EXACTLY 122 guard bytes past the struct end (first=128, last=249; guard values 128..383 monitored) - the exact figure in the finding - writing constants (0x77/0x07/0x0f/0x15/0) into what is really trm_eepromBuf[unit+1..] (the following adapters EEPROM image) or, for the last adapter, past the array in BSS. Control (checksum good) touches nothing. Fixed source (u_int32_t stores + 11-word zero loop - the original also overran by 2 bytes even on ILP32) A/B: zero guard bytes touched.

## Evidence (decisive lines)
DF2525[BAD-CHECKSUM]: sizeof(NVRAMTYPE)=128 NvramTarget offset=10 sizeof(u_long)=8
  0078: 00 00 77 00 00 00 a9 77 00 00 77 00 ...   <- 8-byte straddling stores
DF2525: guard bytes 128..383 smashed=122 first=128 last=249 -> 122 bytes past the 128-byte struct end touched
DF2525: RESULT=OOB WRITE (ILP32 u_long stores spill past NVRAMTYPE)
--- control (checksum good) --- smashed=0 clean
--- fixed source A/B --- smashed=0 clean




## Exploit chain / privesc assessment
attach-time constant-data corruption of adjacent NVRAM images (not attacker-valued); triggered by a bad EEPROM checksum; Low as filed.

## Fix + A/B
fix.diff switches the walk to u_int32_t and shrinks the zero loop to 11 words; A/B zero spills.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.