# VERDICT — DF-3832

**status: inconclusive (source-certain, hardware-gated)** — reproduced: 0 — guest impact: none.

## Index-site inventory (all use raw `unit` / `AdapterUnit`)
| site | expression |
|---|---|
| trm.c:3480 | `trm_check_eeprom(&trm_eepromBuf[unit], pACB)` |
| trm.c:3066 | `pEEpromBuf = &trm_eepromBuf[unit];` (trm_initACB) |
| trm.c:2925 | `pEEpromBuf = &trm_eepromBuf[unit];` (trm_initDCB via `unit` param, also `pACB->AdapterUnit` from trm_action:573) |
| trm.c:1112 | `pEEpromBuf = &trm_eepromBuf[pACB->AdapterUnit];` (trm_ResetDevParam, ISR context) |
| trm.c:3332 | `pEEpromBuf = &trm_eepromBuf[unit];` (trm_initAdapter) |

`unit = device_get_unit(dev)` (trm.c:3549) increments per attached trm device with no ceiling.
`trm_eepromBuf` is `NVRAMTYPE trm_eepromBuf[TRM_MAX_ADAPTER_NUM]` (trm.c:212, TRM_MAX_ADAPTER_NUM=4
at trm.h:90); NVRAMTYPE is the 128-byte SEEPROM image (trm.h:937-959).

## Write proof
`trm_check_eeprom` → `NVRAM_trm_read_all(pEEpromBuf, pACB)` (trm.c:3279):
  `for (bAddr = 0; bAddr < 128; bAddr++, bpEeprom++) *bpEeprom = NVRAM_trm_get_data(pACB, bAddr);`
(trm.c:3181-3182) — 128 bytes stored through `&trm_eepromBuf[4]` on the 5th adapter, i.e. fully
past the 512-byte array. Checksum read (trm.c:3281-3284) reads the same OOB range first.

## Guest
No Tekram PCI device (env.txt) — driver never attaches; not exercisable. Requires 5+ physical
adapters → Low severity, certain at source level.

## Fix
`trm_init`: reject `unit >= TRM_MAX_ADAPTER_NUM` before the first dereference (fix.diff;
`git apply --check` passes).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.