{
  "finding_id": "DF-4246",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "confidence": "certain",
  "impact": "linux_hexdump() memcmp over-reads up to rowsize-1 (31) bytes past the kmallocd ring snapshot on the final partial row (print_request_ring path). Bytes never printed; only observable is a 1-bit equality oracle vs the previous row, on debugfs/error-capture paths.",
  "verdict": "source-verified; hardware-gated (no Intel GPU on audit guest; Low/Info-class)",
  "exploit_chain": [],
  "evidence": "intel_engine_cs.c:1261 memcmp(prev, buf+pos, rowsize) with only len-pos valid; :1437 caller with len%32!=0",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_engine_cs.c:1261",
    "sys/dev/drm/i915/intel_engine_cs.c:1437"
  ],
  "guest_uname": "",
  "code_hash": "",
  "artifact_dir": "findings/poc/DF-4246/",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "clamp the memcmp and row extent to min(rowsize, len-pos) with n==rowsize gate",
  "fix_evidence": "source-only"
}