# DF-3874 VERDICT — inconclusive (hardware-gated), likely

- Bounds mismatch verified in source: counts are u32/u16 DMA fields, arrays
  are 240 / 64 / 15 entries; no clamp anywhere on the paths.
- No user-triggerable input reaches the counts without the firmware writing
  them; requires a faulty/hostile controller -> Low severity, hardware-gated.
- Impact if it fires: heap OOB read + console info leak (event description
  bytes), possible fault on the tail reads (allocation boundary).
- fix.diff clamps all three counts.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.