{
  "finding_id": "DF-2529",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "The verbatim imm_do_scsi OUT branch picks a 2-byte transfer whenever fewer than VP0_SECTOR_SIZE bytes remain (immio.c:743-746); the :739 guard only guarantees 1 byte. With blen=255 and a scripted malicious ZIP+ (status 0x88 until the end), the loop ran to count=256 and the final imm_outstr(&buffer[254], 2) clocked out the guard byte at buffer[255] (0x5A) - one byte past the transfer buffer, captured as OUT[off=255]=5a OOB-READ. The sibling IN branch uses a fallback of 1, confirming the 2 is the defect. Fixed source (fallback 1) A/B: OOB reads=0, transfer completes.",
  "exploit_chain": "malicious parallel-port peripheral (physical access); 1 adjacent kernel heap byte disclosed to the device per transfer.",
  "evidence": "run.log: OOB reads=1 byte=0x5a at buffer[255]; count=256; fixed 0.",
  "kernel_refs": [
    "sys/dev/disk/vpo/immio.c:739",
    "sys/dev/disk/vpo/immio.c:743",
    "sys/dev/disk/vpo/immio.c:746",
    "sys/dev/disk/vpo/vpo.c:279"
  ],
  "poc_changes": "scripted peripheral at the ppb transport boundary (stateful imm_wait); first scripted version answered the command phase with the data-phase status and was fixed.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 700,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_vpo/gen.sh && make -m /usr/src/share/mk (in dfv_vpo)",
  "run_cmd": "kldload dfv_vpo.ko; sysctl kern.dfv_vpo_run=0; sysctl -n kern.dfv_vpo_status",
  "code_hash": "ed340dabe20ecab1e561e2708ec2116b2ebdef1ac6cb4b4f99bb08184f4d9c74",
  "notes": "count=256 proves the loop ran to completion; the single OOB byte is the guard byte past the 255-byte transfer buffer, clocked to the peripheral by the verbatim imm_outstr call. Fixed fallback (len=1) -> OOB reads=0.",
  "recommended_fix": "use 1 (not 2) as the short OUT transfer fallback",
  "fix_status": "fixed"
}