{
  "finding_id": "DF-4229",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain uninitialized-stack return in cyapawrite: zero-length write skips the uiomove loop so `error` (cyapa.c:791) is read at :815/:1054 and returned at :1056 as write()s result. The exact-control-flow harness leaked a stack-poison pattern 3/3 runs on the guest (deterministic mechanism proof); the kernel-side leak itself needs an open /dev/cyapa* fd, impossible on this guest (driver never attaches - no SMBus hardware). 32-bit stale kernel-stack disclosure per call to the fd holder (0600 root:wheel node).",
  "exploit_chain": "hold/inherit fd on /dev/cyapa0-67 -> write(fd, NULL, 0) -> return path returns unassigned `error` -> stale kernel stack int observable as errno/retval; repeat to sample thread-stack contents (KASLR-relevant fragments)",
  "evidence": "run.log + build.log (3/3 poison 0xABABABAB through `return error;` model), VERDICT.md (every hop cited), fix.diff",
  "kernel_refs": [
    "sys/dev/smbus/cyapa/cyapa.c:791",
    "sys/dev/smbus/cyapa/cyapa.c:802",
    "sys/dev/smbus/cyapa/cyapa.c:1056",
    "sys/kern/sys_generic.c:506"
  ],
  "poc_changes": "n/a - pack authored fresh",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O0 -Wall -o model_uninit_error model_uninit_error.c",
  "run_cmd": "./model_uninit_error",
  "code_hash": "601ee18525359c64169e8720843a3abf672256184dd7799b211f3ee31d29ef35",
  "notes": "impact field = observed on THIS guest (harness mechanism leak; kernel-side leak hardware-gated).",
  "recommended_fix": "initialize: int error = 0; (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line initializer; kernel-side validation needs the physical device (absent in QEMU). Applies cleanly to sys/.",
  "fix_evidence": "findings/poc/DF-4229/fix.diff (git apply --check clean)"
}