{
  "finding_id": "DF-4129",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "seq_sync() sizes its per-unit flag array at 16 (sequencer.c:2063) but loops over scp->midi_number, bounded only by the 32-entry midis[] allocation \u2014 17..32 attached MIDI units write 4..64 bytes of 0x1 past sync[16] on the kernel stack of an unprivileged thread via SNDCTL_SEQ_SYNC or close(). Live-reproduced on the guest: 32 harness fake MPU units + wired sequencer (stock DragonFly has the sequencer dead-coded at midi.c:1509) -> Fatal user address access from kernel mode from seq_sync_oob at 0x0, RIP=0, FP=0x0 (kernel control-flow corruption demonstrated as reliable local panic). fix.diff (shared MIDIDEV_MAX=32 sizing + enumeration clamp) validated in the same run: identical trigger completes cleanly, guest up.",
  "exploit_chain": "unpriv open(/dev/sequencer0,0666) -> ioctl(SNDCTL_SEQ_SYNC) -> seq_sync writes sync[16..31]=1 past the array, smashing saved regs/RBP/RIP with 1-pattern words -> return to ~0 -> Fatal trap 12 in the unprivileged process. Content is the constant 1 (count attacker-set, data not), so the demonstrated ceiling is reliable kernel-stack control-flow corruption/panic; no uid=0 route found (no data control, no pairing leak). Precondition: >=17 registered snd_midi units AND the sequencer personality being wired (dead code on stock DragonFly: midi.c:1509 #if 0 \u2014 verified live, kldload sound creates no /dev/sequencer).",
  "evidence": "panic.txt (fatal trap 12, RIP=0x0, frame pointer=0x0, from seq_sync_oob at 0000000000000000, preceding noinsync stub prints = the OOB read loop); baseline_stock.log (stock sound: no /dev/sequencer \u2014 dead wiring); wired_load.log (/dev/sequencer0+/dev/music0 0666 after wiring); fakempu_load.log (32/32 units); fix_run.log ([+] survived 3 open/sync/close cycle(s), rc=0, guest up on fix.diff)",
  "kernel_refs": [
    "sys/dev/sound/midi/sequencer.c:2063",
    "sys/dev/sound/midi/sequencer.c:2122",
    "sys/dev/sound/midi/sequencer.c:2124",
    "sys/dev/sound/midi/sequencer.c:2128",
    "sys/dev/sound/midi/sequencer.c:766",
    "sys/dev/sound/midi/sequencer.c:541",
    "sys/dev/sound/midi/midi.c:1509"
  ],
  "poc_changes": "PoC authored fresh (no seed): unprivileged trigger open+SYNC+close; fakempu.ko harness kld registering 32 fake MPU-401 UARTs via exported midi_init() (max units that avoids the known DF-1394 heap bound); 2-line PoC-wiring patch re-enabling the dead-coded sequencer personality (midi.c #if 0 -> 1, sequencer.c untouched); first fixed-kernel harness used 128B out-queues and hung in midisynth_writeraw during seq_reset (fake UART never drains) \u2014 harness artifact, rerun with 1024B queues clean.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2820,
  "guest_dirty": 0,
  "build_cmd": "sh /tmp/df4129/build.sh; cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC (after wiring_enable.diff [+fix.diff])",
  "run_cmd": "kldload sound && kldload /tmp/fakempu.ko && su - maxx -c /tmp/seq_sync_oob",
  "code_hash": "a49348a4d0de901dc3ba498b4c2c25d7b07814e83c123718be845d69140c2da4",
  "notes": "Pass-2 reachability discovery: the whole /dev/sequencer surface is dead code on stock DragonFly (seq_modevent call #if 0 at midi.c:1509; no module registration in sequencer.c) \u2014 verified live. Also observed pre-existing sndstat_sysuninit panic on kldunload sound (already on file from DF-4115 pack, sndstat.c owner). Dead-wiring downgrade reflected in severity (Low).",
  "recommended_fix": "size sync[] (and midis/midi_flags + the seq_open enumeration) with one shared MIDIDEV_MAX=32 constant \u2014 fix.diff validated",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (MIDIDEV_MAX=32 for sync[]/midis/midi_flags + enumeration clamp in seq_open) applied in-guest on top of the PoC wiring, kernel+sound.ko rebuilt: the exact trigger that panicked (fatal trap 12, RIP=0) now completes 3 open/SNDCTL_SEQ_SYNC/close cycles with rc=0 and the guest stays up. The clamp also closes the DF-1394 >32-unit heap window.",
  "fix_evidence": "baseline: panic.txt (fatal trap 12 from seq_sync_oob, RIP=0x0) | patched: fix_run.log ([*] SNDCTL_SEQ_SYNC -> rc=0 x3, [+] survived 3 open/sync/close cycle(s), TRIGGER-RC=0, vm status up)"
}