# DF-2884 VERDICT — REPRODUCED (impact: none — hardening)

## Root cause

`sys/kern/subr_scanf.c:148-253`: the conversion-character switch
(`case '%', '*', l, q, h, 0-9, d, i, o, u, x, s, [, c, p, n`) lacks a
`default:` arm. An unrecognized specifier falls through with `c` set
to that character; the code then runs the input-failure check and the
whitespace skip (side effects on input), and the second switch at
:283-535 (cases CT_CHAR/CT_CCL/CT_STRING/CT_INT only) silently does
nothing. No varargument is consumed → all subsequent conversions bind
to shifted arguments.

## Proof

Stock kernel #0 (E5, through `kvsscanf` because cc's `__scanflike(2,3)`
on `ksscanf` rejects `"%f%d"` outright — itself demonstrating the
specifier is unsanctioned):

```
dfpoc: E5 '5' %f%d: ret=1 a=5 b=-1   ← %d stored through &a; &b never written
```

Patched kernel #1 (fix.diff hunk 1, `default: goto match_failure`):

```
dfpoc: E5 '5' %f%d: ret=0 a=-1 b=-1  ← rejected, nothing written
```

## Impact

Argument misassociation: a later `%s` would write a string through the
pointer intended for a scalar conversion (caller-object overflow
hazard), later `%c`/`%d` write through wrong pointers. Reachable only
via runtime-built formats or unannotated wrappers, and no in-tree
caller uses an unsupported specifier (21 sites surveyed) → Info
(hardening), certain confidence. Userland vfscanf rejects unknown
conversions; this aligns the kernel engine.