{
  "finding_id": "DF-4138",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ppc_pc873xx_detect uses a function-static index that is never reset (ppc.c:435); on the second and later invocations pc873xx_basetab[index++] reads past the 5-entry table and the garbage value is used as an x86 I/O port for inb/outb (including writes) - unbounded OOB reads of kernel .data turned into semi-arbitrary port I/O. Gated on options PPC_PROBE_CHIPSET (LINT64-only; ppc is not in GENERIC) and multiple probe invocations, so hardware/option-gated: source-level certainty, no live guest (no ISA parallel port).",
  "exploit_chain": "",
  "evidence": "README.md analysis (ppc.c:415,435,439-460)",
  "kernel_refs": ["sys/dev/misc/ppc/ppc.c:415", "sys/dev/misc/ppc/ppc.c:435", "sys/dev/misc/ppc/ppc.c:439", "sys/dev/misc/ppc/ppc.c:459"],
  "poc_changes": "n/a - analysis only",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "notes": "Guest has no parallel port; driver not in X86_64_GENERIC.",
  "recommended_fix": "Make the probe index a local (reset per call).",
  "fix_status": "not_applicable"
}