{
  "finding_id": "DF-4184",
  "title": "acd_fixate() MODE SELECT data-out sized by device-fed page_length over-reads the 64-byte stack write_param (kernel stack disclosure to crafted ATAPI device)",
  "verdict": "reproduced",
  "impact": "leak",
  "reproduce": {
    "build": "guest: cc -O -o /tmp/fixate_stackread /tmp/fixate_stackread.c ; kernel: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC (with emu_notes.txt device hook + df_audit.mode=1)",
    "run": "/tmp/fixate_stackread /dev/acd0",
    "expected": "kernel console: 'hook ccb0=55 ... cnt=265' + over-read hexdump containing 0xfffff8../0xffffffff80.. kernel pointers; ioctl returns 0 after the fixate wait"
  },
  "kernel_refs": ["sys/dev/disk/nata/atapi-cd.c:1140", "sys/dev/disk/nata/atapi-cd.c:1150", "sys/dev/disk/nata/atapi-cd.c:1674", "sys/dev/disk/nata/ata-queue.c:188", "sys/dev/disk/nata/atapi-cd.h:84"],
  "artifacts": ["README.md", "VERDICT.md", "fixate_stackread.c", "build.sh", "run.sh", "run.log", "leak_sample.txt", "dfaud_dmesg_raw.txt", "build.log", "fix.diff", "fix_run.log", "fix.2.log", "env.txt", "userland_runs.txt", "fix_userland_runs.txt", "fix_dmesg_full.txt", "emu_notes.txt", "verdict.json", "manifest.json"]
}