# DF-4138 — `ppc_pc873xx_detect()` static probe index is never reset:
# OOB read past `pc873xx_basetab[]` used as an I/O port number

## Root cause
`sys/dev/misc/ppc/ppc.c:432-439`:

```c
static int
ppc_pc873xx_detect(struct ppc_data *ppc, int chipset_mode)
{
    static int	index = 0;			/* <-- static, never reset */
    ...
    while ((idport = pc873xx_basetab[index++])) {
	(void)inb(idport); ...
	outb(idport, PC873_SID);
	val = inb(idport + 1);
```

`pc873xx_basetab[]` (ppc.c:415) has 5 entries (4 ports + 0 sentinel).
`index` is a function-static that is **never re-initialized**; every call
to `ppc_pc873xx_detect` resumes where the previous one stopped.

* 1st call (1st parallel port): walks the table from 0.
* 2nd call (2nd port, or a re-probe): `pc873xx_basetab[5]`, `[6]`, ...
  — **out-of-bounds reads of kernel .data past the table**.  The values
  read there (e.g. `pc873xx_porttab[]` = 0x378/0x3bc/0x278, then
  `pc873xx_irqtab[]`, then the `pc873xx_regstab[]` contents and finally
  the *pointer* values of `pc873xx_rnametab[]`) are used as `idport`:
  `inb(idport)` / `outb(idport, PC873_SID)` / `inb(idport + 1)` are
  executed on arbitrary port numbers — including **writes** to
  semi-arbitrary x86 I/O ports (keyboard 0x60/0x64, POST/reset 0xCF9,
  CMOS 0x70/0x71 are all in reach depending on adjacent .data), and the
  loop keeps advancing on every call, reading further and further past
  the array.

## Reachability
Gated on `options PPC_PROBE_CHIPSET` (ppc.c:406/1274/1295): not in
GENERIC (X86_64_GENERIC does not compile ppc at all); enabled only in
LINT64 or custom kernels, and needs >= 2 ppc attach attempts through the
chipset detect loop (2+ ISA parallel ports, or repeated probes).  The
`ppc` driver itself is not in the shipped GENERIC kernel and the
paravirtual guest has no ISA parallel port, so this is source-level
certainty only.

## Fix
```diff
--- a/sys/dev/misc/ppc/ppc.c
+++ b/sys/dev/misc/ppc/ppc.c
@@ -433,7 +433,7 @@
 static int
 ppc_pc873xx_detect(struct ppc_data *ppc, int chipset_mode)
 {
-    static int	index = 0;
+    int		index = 0;
     int		idport, irq;
     int		ptr, pcr, val, i;
```
(the variable was pointlessly static; it must start at 0 per probe).

## Verification
Skipped live (hardware-gated: guest has no parallel port; driver not in
GENERIC; option not enabled).  Analysis-certain: the missing reset is
unambiguous from source.