{
  "finding_id": "DF-3580",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Inverted privilege-check result in iwn_cdev_ioctl(): if_iwn.c:5157-5160 returns 0 (success) when caps_priv_check() FAILS, instead of propagating rc/EPERM. Effectively fail-closed (unprivileged callers get errno 0 but no data; node is 0600 root:wheel anyway), so no access bypass exists today — filed as Info/hardening because an inverted security-check return is a hazardous pattern one refactor away from a real bypass. Untestable on the virtio-only guest (cdev exists only with iwn hardware). Code is unambiguous, hence confidence certain.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (code excerpt + impact analysis), fix.diff (one-line fix), README.md.",
  "kernel_refs": [
    "sys/dev/netif/iwn/if_iwn.c:5157",
    "sys/dev/netif/iwn/if_iwn.c:5160",
    "sys/dev/netif/iwn/if_iwn.c:5166",
    "sys/dev/netif/iwn/if_iwn.c:776"
  ],
  "poc_changes": "none — Info-level logic bug; no PoC authored.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Typo inherited from FreeBSD if_iwn.c (priv_check + return 0). SIOCGIWNSTATS also ignores d->dst_len (copyout length is a fixed sizeof(struct iwn_stats), so no overflow).",
  "recommended_fix": "Propagate the caps_priv_check failure: return (rc);",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "one-line logic fix; not validated on guest (no iwn cdev without hardware).",
  "fix_evidence": "findings/poc/DF-3580/fix.diff"
}