{
  "finding_id": "DF-3886",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated, source-certain: drm_dp_sideband_msg_build appends each completed chunk with memcpy(&msg->msg[curlen], chunk, curchunk_len-1) where curchunk_len is the hubs 6-bit header msg_len (<=63) and curlen (u8) is never validated against 256 (drm_dp_mst_topology.c:371-377). A >256-byte reply (15-port LINK_ADDRESS ACK = 333 bytes, 6 chunks) walks the append offset past the array: up to 61 hub-controlled bytes overwrite curlen/have_somt/have_eomt/initial_hdr and the adjacent up_req_recv of the same mgr (helper.h:215-226,464-470). Distinct sink from DF-1264 (chunk[48] continuation branch, line 367) and DF-1265 (parser reads): different array, different branch, different fix. Guest has no GPU (env.txt); the compiled assembler model reproduces the exact overrun (chunk 5, 54 bytes past, run.log).",
  "exploit_chain": "malicious hub sends a long but spec-shaped down-reply (no malformed fields needed) -> 5th 62-byte append starts at &msg[248] -> 54 bytes of hub data past msg[256] corrupt have_eomt/curlen/initial_hdr (steering downstream parse + device lookup at :2324) and pre-seed up_req_recv.chunk with smuggled bytes.",
  "evidence": "run.log (chunk-by-chunk offsets + clobbered-field dump), VERDICT.md (attacker-input-to-sink trace and known-finding differentiation), env.txt",
  "kernel_refs": [
    "sys/dev/drm/drm_dp_mst_topology.c:375",
    "sys/dev/drm/drm_dp_mst_topology.c:376",
    "sys/dev/drm/drm_dp_mst_topology.c:190",
    "sys/dev/drm/include/drm/drm_dp_mst_helper.h:217"
  ],
  "poc_changes": "no seed; model authored from scratch mirroring struct field order",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o sbmsg_accum_model sbmsg_accum_model.c",
  "run_cmd": "./sbmsg_accum_model",
  "code_hash": "7395877fcfae413c30e44544c4a3ed9a32f79faf2eb57cef1933b38f6354845d",
  "notes": "Trigger is easier than DF-1264s: fully spec-conformant long reply, no malformed lengths.",
  "recommended_fix": "Pre-append bound check: reject when curlen + curchunk_len - 1 exceeds sizeof(msg->msg) in drm_dp_sideband_msg_build",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the pre-append bound (return false on overflow); kernel-side validation impossible on this guest (no DP hardware), so fix_status=not_testable.",
  "fix_evidence": "findings/poc/DF-3886/fix.diff"
}