{
  "finding_id": "DF-3881",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated, source-certain: nothing bounds mstb->lct, which grows +1 per nested branch claimed by the hub (drm_dp_calculate_rad:1065 returns parent_lct+1). From parent_lct>=13 drm_dp_calculate_rad memcpy/rad[idx]|= writes past the u8 rad[6] stack array of drm_dp_port_setup_pdt:1074; from lct>=17 drm_dp_add_mst_branch_device:850 overruns heap mstb->rad[8] and set_hdr_from_dst_qlock:1485 overruns stack hdr->rad[8]; drm_dp_mst_dump_mstb:2962 overruns prefix[10] for lct>=10; the LINK_ADDRESS->add_port->send_link_address recursion (:1639->:1198) is likewise unbounded (~300B kernel stack per level, 16KB stack exhausted ~depth 54). Guest has no GPU (/dev/dri absent, env.txt) so the kernel path is not executable here; the compiled arithmetic model reproduces every OOB offset (run.log).",
  "exploit_chain": "malicious DP hub claims 12+ nested branch levels via LINK_ADDRESS replies -> 1-2-byte stack overwrite in drm_dp_port_setup_pdt (rad[6]|=port_num<<shift at attacker offset); 16+ levels -> 1-byte heap overflow past drm_dp_mst_branch.rad[8] (adjacent lct/num_ports/ports list_head/mgr/tx_slots/guid); ~54 levels -> deterministic kernel stack exhaustion (DoS).",
  "evidence": "run.log (first-OOB table: 13/17/17/10), VERDICT.md (line-by-line trace), env.txt (no /dev/dri, no drm kld)",
  "kernel_refs": ["sys/dev/drm/drm_dp_mst_topology.c:1052", "sys/dev/drm/drm_dp_mst_topology.c:1074", "sys/dev/drm/drm_dp_mst_topology.c:850", "sys/dev/drm/drm_dp_mst_topology.c:1485", "sys/dev/drm/drm_dp_mst_topology.c:1198", "sys/dev/drm/drm_dp_mst_topology.c:2962"],
  "poc_changes": "no seed existed; model authored from scratch to mirror the four sink buffers exactly",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 40,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o mst_lct_model mst_lct_model.c",
  "run_cmd": "./mst_lct_model",
  "code_hash": "39333f34006164915cfd55cd0e240d4f3b91bbb4aa92690485396abea23038bf",
  "notes": "Distinct from DF-1264 (chunk[48] in sideband_msg_build) and DF-1265 (reply parser reads): this is the topology/RAD depth arithmetic. Same malicious-hub threat actor.",
  "recommended_fix": "Cap lct at 16 in drm_dp_add_mst_branch_device (kfree on reject), refuse RAD computation for parent_lct>12 in drm_dp_calculate_rad, size dump prefix[18]",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree (lct>16 reject + parent_lct>12 RAD guard + prefix[18]); kernel validation impossible on this guest (no GPU: the fixed path cannot be exercised even with a rebuilt kernel), so fix_status=not_testable rather than fixed.",
  "fix_evidence": "findings/poc/DF-3881/fix.diff"
}