{
  "finding_id": "DF-3832",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "trm_eepromBuf is a 4-entry global (TRM_MAX_ADAPTER_NUM, trm.h:90; trm.c:212) but is indexed by the unbounded devclass unit everywhere: trm_check_eeprom(&trm_eepromBuf[unit], ...) at trm.c:3480, trm_initACB at trm.c:3066, trm_initDCB at trm.c:2925 and trm_ResetDevParam at trm.c:1112. With five Tekram adapters attached, unit=4 selects storage one full NVRAMTYPE (128 bytes) past the array: NVRAM_trm_read_all then writes all 128 SEEPROM bytes through the out-of-range pointer (trm.c:3181-3182), the checksum loop reads 128 bytes (trm.c:3281-3284), and the defaults path writes further — a boot-time corruption of whatever .bss data follows trm_eepromBuf. Distinct from DF-2525 (that is the u_long/4-byte schema overflow inside a valid entry); this is the missing index bound. Not exercisable on the audit guest (a single-adapter QEMU has no Tekram HBA at all, env.txt); requires 5+ physical adapters, hence severity Low.",
  "exploit_chain": "physical: install 5+ DC395 adapters -> 5th attach writes 128 bytes of SEEPROM-derived data past trm_eepromBuf[] into adjacent kernel globals -> uncontrolled kernel-state corruption at boot.",
  "evidence": "README.md (all five index sites cited); env.txt; fix.diff (unit bound check in trm_init, git-apply --check passes)",
  "kernel_refs": ["sys/dev/disk/trm/trm.c:212", "sys/dev/disk/trm/trm.c:3480", "sys/dev/disk/trm/trm.c:3066", "sys/dev/disk/trm/trm.c:2925", "sys/dev/disk/trm/trm.c:1112", "sys/dev/disk/trm/trm.c:3181", "sys/dev/disk/trm/trm.h:90", "sys/dev/disk/trm/trm.h:937"],
  "poc_changes": "PoC would need five physical Tekram PCI cards; pack is analysis + fix only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Pass-2 hunt item (e): the eeprom path beyond the DF-2525 u_long write — other type/bound mismatches. The unit bound was the surviving one.",
  "recommended_fix": "Reject unit >= TRM_MAX_ADAPTER_NUM in trm_init before any trm_eepromBuf[] dereference (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Requires 5+ physical Tekram adapters for both baseline and patched runs; impossible on the audit guest. fix.diff is git-apply-able (verified).",
  "fix_evidence": "fix.diff"
}