{
  "finding_id": "DF-4134",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain 4-byte OOB write (vol->plex[MAXPLEX] at vinumconfig.c:205 after the swallowed throw at :199) plus vol->plexes>MAXPLEX on the VF_READING_CONFIG path from crafted media. Live test skipped: on DragonFlys power-of-two kmalloc buckets the write lands in intra-bucket slack for the last VOL element (sizeof(struct volume)*n is never a power of two) and in VOL[n+1].name otherwise, so no cross-object corruption is achievable - impact is config corruption only. Findings is filed for correctness/defense-in-depth.",
  "exploit_chain": "",
  "evidence": "README.md analysis (struct layout math, throw_rude_remark return-in-reading-mode at vinumconfig.c:125-132)",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumconfig.c:198",
    "sys/dev/raid/vinum/vinumconfig.c:205",
    "sys/dev/raid/vinum/vinumconfig.c:125",
    "sys/dev/raid/vinum/vinumvar.h:634"
  ],
  "poc_changes": "n/a - analysis only",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "notes": "Low severity; same crafted-disk vector as DF-4133.",
  "recommended_fix": "Return immediately after the Too many plexes throw (or make throw_rude_remark longjmp-safe on this path).",
  "fix_status": "not_applicable"
}