{
  "finding_id": "DF-3631",
  "file": "sys/dev/netif/iwm/if_iwm.c",
  "verdict": "reproduced (logic-level harness; kernel path inconclusive)",
  "impact": "kernel heap OOB read walk in firmware parser (crafted firmware file required)",
  "reproduce": {
    "build": "cc -O2 -Wall -o tlv_underflow tlv_underflow.c",
    "run": "./tlv_underflow A; ./tlv_underflow B",
    "expected": "kernel-path: n/a (no iwm hardware). DF-3631 harness: SIGSEGV exit 139 in both cases pre-fix; clean exit 0 post-fix"
  },
  "kernel_refs": [
    "sys/dev/netif/iwm/if_iwm.c:607",
    "sys/dev/netif/iwm/if_iwm.c:620",
    "sys/dev/netif/iwm/if_iwm.c:630",
    "sys/dev/netif/iwm/if_iwm.c:637",
    "sys/dev/netif/iwm/if_iwm.c:638",
    "sys/dev/netif/iwm/if_iwm.c:2427"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "tlv_underflow.c",
    "tlv_underflow_fixed.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "run_fixed.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ],
  "guest": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}