# DF-4244 verdict — UNTESTED at kernel level (hardware-gated); walk arithmetic PROVEN on guest

## Reproduced?
Harness: **YES** — dpt_df4244_walk.c embeds the DPT_HCP_* macros verbatim
(dpt.h:341-344) and the exact loop (dpt_scsi.c:663-669) over a faithful
model (512-byte DMA buffer inside a 4096-byte bus_dmamem page). Guest run
(run.log):

    walk stopped after 16383 accepted steps at buff+65536
    reads OUTSIDE the 512-byte DMA buffer : 16257 iterations
      of which past the whole 4096B sg page: 15361
    bound used by driver : &buff[bytes] = buff+65539   <- device-fed
    bound that is safe   : &buff[512]                  <- actual transfer

Kernel-level: **UNTESTED** — needs a DPT controller returning a bogus page
length; none in the guest (env.txt).

## Impact
OOB kernel *read* (up to ~65 KB past the transfer), values never copied to
userspace (only `cache_type` decisions, dpt_scsi.c:671-681) → no leak; the
realistic ceiling is a page-fault panic during attach from reading unmapped
kernel VA, plus unbounded loop time. Severity Low.

## Fix validation
Not possible without hardware; fix.diff clamps `bytes` to the 512 bytes
actually requested.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.