# DF-4339 VERDICT

**Status: inconclusive (kernel runtime hardware-gated; logic-level
reproduced on the audit guest). Defect: certain.**

## Root cause

atom.c:1276 `char name[512]` is not initialized; the copy loop
atom.c:1319-1325 writes at most name[0..510] and only NUL-terminates inside
the `break` path. If the bios message contains 511 consecutive bytes in
[0x2E,0x7A] the loop completes without break and name[511] keeps its
uninitialized stack value; `DRM_INFO("ATOM BIOS: %s\n", name)`
(atom.c:1326) then reads past the buffer into adjacent kernel stack until a
NUL. Additionally `str = CSTR(CU16(base + ATOM_ROM_MSG_PTR))` (atom.c:1315)
and the copy walk are unbounded against the bios allocation (OOB heap read).

## Reproduction

Guest has no ATI GPU (env.txt) → kernel path unrunnable; logic-level PoC on
the guest (verbatim loop):

- `name` case: msg string of 300 'B's ending exactly at the (guarded) image
  end → **Segmentation fault, exit 139** (the str walk reads past the bios
  allocation).
- `name_nul` case: fully in-bounds 511 printable bytes, name[511] poisoned
  like uninit stack → **strlen(name) = 515**: the `%s` read runs 4 bytes
  past the 512-byte buffer (stops at an incidental NUL at name[515]).
  In-kernel the same read discloses kernel-stack bytes to the console/log.

## Fix validation (logic level)

fix.diff: `char name[512] = { 0 };` → harness `name_nul` fixed case gives
strlen=511 (always terminated); `name` case with DF-4337's bios bound stops
at the image end (fix_run.log in DF-4337/). `git apply --check` OK.
Kernel/on-hardware validation not possible (no ATOM GPU on guest) →
fix_status inconclusive.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.