# DF-2529 verdict -- 1-byte heap OOB read in imm_do_scsi OUT-data path

status: reproduced   reproduced: 1   impact: leak
confidence: certain   attempts: 2   runtime_sec: 700

The verbatim imm_do_scsi OUT branch picks a 2-byte transfer whenever fewer than VP0_SECTOR_SIZE bytes remain (immio.c:743-746); the :739 guard only guarantees 1 byte. With blen=255 and a scripted malicious ZIP+ (status 0x88 until the end), the loop ran to count=256 and the final imm_outstr(&buffer[254], 2) clocked out the guard byte at buffer[255] (0x5A) - one byte past the transfer buffer, captured as OUT[off=255]=5a OOB-READ. The sibling IN branch uses a fallback of 1, confirming the 2 is the defect. Fixed source (fallback 1) A/B: OOB reads=0, transfer completes.

## Evidence (decisive lines)
DF2529: OUT transfer blen=255, buffer[255]=0x5A guard; count=256 ret=0 error=0
DF2529: OOB reads=1 byte=0x5a at buffer[255] (PAST the transfer buffer)
DF2529: log: OUT[off=255]=5a OOB-READ
DF2529: RESULT=1-BYTE HEAP OOB READ clocked to the peripheral (len=2 picked with exactly 1 byte remaining)
--- fixed source A/B ---
DF2529: OOB reads=0 ... RESULT=no OOB




## Exploit chain / privesc assessment
malicious parallel-port peripheral (physical access); 1 adjacent kernel heap byte disclosed to the device per transfer.

## Fix + A/B
fix.diff uses 1 as the short OUT fallback (matches the IN branch); A/B zero OOB.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.