{
  "finding_id": "DF-3577",
  "title": "4-byte heap OOB read in iwn_read_firmware_tlv() IWN_FW_TLV_PHY_CALIB case (missing len>=4 check)",
  "verdict": "reproduced (verbatim parser harness; SIGSEGV at guard page 4/4; fixed variant clean)",
  "impact": "none (no leak path; CWE-125 memory-safety defect)",
  "reproduce": {
    "build": "cc -O2 -Wall -o iwn_tlv_oob iwn_tlv_oob.c && cc -O2 -Wall -o iwn_tlv_oob_fixed iwn_tlv_oob_fixed.c",
    "run": "./iwn_tlv_oob guard; ./iwn_tlv_oob_fixed guard",
    "expected": "baseline: exit 139 (SIGSEGV, 4-byte read at PROT_NONE boundary); fixed: clean return, no fault"
  },
  "kernel_refs": [
    "sys/dev/netif/iwn/if_iwn.c:8280",
    "sys/dev/netif/iwn/if_iwn.c:8315",
    "sys/dev/netif/iwn/if_iwn.c:8316",
    "sys/dev/netif/iwn/if_iwn.c:8327",
    "sys/dev/netif/iwn/if_iwn.c:8375"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "iwn_tlv_oob.c", "iwn_tlv_oob_fixed.c",
    "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "env.txt",
    "fix.diff", "verdict.json", "manifest.json"
  ]
}