{
  "finding_id": "DF-3594",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Source-certain missing guard in bwn_intr_noise (if_bwn.c:5189-5209): NOISESAMPLE_OK stays unmasked in BWN_INTR_MASKTEMPLATE (if_bwnreg.h:324-328) after the 8-sample window closes (noi_running=0 at if_bwn.c:5225), so a 9th/stale firmware noise interrupt indexes noi_samples[8] \u2014 a 4-byte OOB write into the adjacent struct bwn_phy within the kmallocd bwn_mac (if_bwnvar.h:576-580, 917-918). INVARIANTS kernels (stock DF) panic at KASSERT if_bwn.c:5198 instead. Guest has no Broadcom 802.11 device (run.log) so runtime trigger impossible; trigger class = duplicate/stale device interrupt, the same firmware behavior the driver documents for TX-done (if_bwn.c:7088-7091) or a malicious card.",
  "exploit_chain": "",
  "evidence": "VERDICT.md path:line trace incl. struct layout adjacency; run.log guest probe; fix.diff adds noi_running/nsamples entry guard",
  "kernel_refs": [
    "sys/dev/netif/bwn/bwn/if_bwn.c:5205",
    "sys/dev/netif/bwn/bwn/if_bwn.c:5225",
    "sys/dev/netif/bwn/bwn/if_bwnreg.h:324",
    "sys/dev/netif/bwn/bwn/if_bwnvar.h:579"
  ],
  "poc_changes": "No runnable PoC possible without hardware; probe.sh substitutes",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (X86_64_GENERIC, INVARIANTS)",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level; probe.sh only)",
  "run_cmd": "vm.sh run_root sh probe.sh",
  "code_hash": "1dd0c720eadc950b8900406eb0ca725b8ba6f8b9f6969a1e3214900e2a1dc703",
  "notes": "Memory-corruption variant only on non-INVARIANTS builds; write offset fixed (+0 into mac_phy), value domain = 64-entry RSSI LUT (RF-influenced) \u2014 corruption with limited control, realistic outcome panic. Not remotely triggerable by RF alone; requires device-side interrupt anomaly.",
  "recommended_fix": "Early-return in bwn_intr_noise unless noi_running && noi_nsamples < 8",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/; cannot baseline-validate without BCM43xx hardware",
  "fix_evidence": "fix.diff in this pack"
}