{
 "finding_id": "DF-3125",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "leak",
 "confidence": "likely",
 "verdict": "The mount path was reached and fails cleanly: mount_cd9660 -C with a 31-byte non-NUL charset returns cd9660_iconv Invalid argument after the kernel bcopy and the iconv_open strcmp walk; a control mount with a valid charset succeeds on the same image. The over-read itself (strcmp past the 31-byte stack array until an accidental zero) is bounded and produces no externally observable state on this kernel, and the stock mount_cd9660 CLI additionally validates charset names in userland first, so the un-terminated strcmp walk requires a direct mount(2) caller. Bounded stack over-read, no demonstrated disclosure. Fix forces termination after the bcopy; compile-validated.",
 "exploit_chain": "",
 "evidence": "run.log (control mount OK vs 31-byte garbage EINVAL at the iconv layer)",
 "kernel_refs": [
  "sys/vfs/isofs/cd9660/cd9660_vfsops.c:197",
  "sys/vfs/isofs/cd9660/cd9660_vfsops.c:492-493"
 ],
 "poc_changes": "",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "host: python3 ../DF-3206/craft_dotdot_iso.py img (any valid ISO)",
 "run_cmd": "guest: kldload libiconv cd9660_iconv; mount_cd9660 -o ro -C <31-char-garbage> /dev/vn2 /mnt (fails at iconv lookup) vs -C ISO8859-1 (succeeds)",
 "code_hash": "",
 "notes": "",
 "recommended_fix": "cs_local/cs_disk forced NUL-terminated after the bcopy"
}