{
  "finding_id": "DF-3841",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime inconclusive: no iwi NIC on the guest, and installing replacement firmware requires root (the DF-3573/3591/3631 family trust boundary). The malformed-image generator ran on the guest (run.log: wrote /tmp/iwi_bss_bad with usize=9). With odd fw->size the ucode loops size -= 2 wraps size_t to SIZE_MAX -> unbounded kernel OOB read + lock-held spin until a page fault panics; the load_firmware walk has no tail or len bounds. Same pattern as DF-3631 (iwm TLV underflow).",
  "exploit_chain": "",
  "evidence": "README.md (what to look at), VERDICT.md (line-by-line trace), trigger.c/mkbadfw.c, build.log (clean guest compile, gcc 8.3), run.log (honest ENOENT / generator RUN_OK), env.txt (guest has no DRI, no iwi NIC), fix.diff",
  "kernel_refs": [
    "sys/dev/netif/iwi/if_iwi.c:2446",
    "sys/dev/netif/iwi/if_iwi.c:2228",
    "sys/dev/netif/iwi/if_iwi.c:2362",
    "sys/dev/netif/iwi/if_iwi.c:2506",
    "sys/dev/netif/iwi/if_iwi.c:2525",
    "sys/dev/netif/iwi/if_iwi.c:3139"
  ],
  "poc_changes": "PoC authored fresh for this finding (cross-file family seed): raw DRM ioctl ABI (cmd low byte 0x66 dispatches RADEON_CS on DF drm_ioctl.c:809), chunk structs and packet encodings verified against sys/dev/drm/include/uapi/drm/radeon_drm.h; iwi mkbadfw.c emits the v3 combined-image header per if_iwireg.h:161-166.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o mkbadfw mkbadfw.c",
  "run_cmd": "./mkbadfw iwi_bss_bad",
  "code_hash": "54636dd1fd4c7fddfdd2bede724c57e43ae588f2cb691081c4cd9bbca6807597",
  "notes": "Hardware-gated: audit QEMU guest is virtio-only (no /dev/dri, hw.drm absent, no iwi PCI NIC) - runtime verification impossible in this environment; classification per orchestrator enum (no not_testable/skipped). Guest was NOT dirtied; no kernel rebuild performed (nothing reproduced to validate a fix against).",
  "recommended_fix": "Reject odd ucode sizes; require 8 remaining bytes for a command-block header and len <= remaining data.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation impossible on this guest: the vulnerable device (AMD radeon CS / Intel 2200BG) does not exist, so neither baseline nor patched kernel can exercise the path. fix.diff authored against the read-only sys/ tree, never applied.",
  "fix_evidence": "fix.diff in this pack; structurally mirrors the bounds checks the same driver family already enforces elsewhere (radeon_cs_packet_parse fit check; iwn ring-index masking)."
}