{
  "finding_id": "DF-4339",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain: the atom_parse name loop (atom.c:1319-1325) never writes name[511] when all 511 bytes are printable, so DRM_INFO(\"%s\", name) at atom.c:1326 reads uninitialized kernel stack past the 512-byte buffer until an incidental NUL (guest mirror: strlen=515, i.e. 4 bytes past the buffer); the msg pointer itself is also walked unbounded past the bios allocation (mirror: SIGSEGV 139). Impact is a limited kernel-stack disclosure to console/log, gated on a crafted VBIOS \u2014 Low. Kernel runtime hardware-gated (no ATI GPU on guest).",
  "exploit_chain": "",
  "evidence": "run_cases.log [name] Segmentation fault exit=139 and [name_nul] strlen(name)=515; VERDICT.md",
  "kernel_refs": [
    "sys/dev/drm/radeon/atom.c:1276",
    "sys/dev/drm/radeon/atom.c:1315",
    "sys/dev/drm/radeon/atom.c:1319",
    "sys/dev/drm/radeon/atom.c:1326"
  ],
  "poc_changes": "no seed; verbatim loop with name[511] poisoned to simulate uninit stack",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O1 -g -o atom_harness atom_harness.c (on DragonFly guest)",
  "run_cmd": "./atom_harness name; ./atom_harness name_nul",
  "code_hash": "25677f802601b62268f4d213ef9e2af03250f6c9a544bae5cd4cbfd214ffe6fe",
  "notes": "The amdgpu twin prints the string with no filtering at all (amd/amdgpu/atom.c amdgpu_atom_parse: pr_info(\"ATOM BIOS: %s\", str)) \u2014 same class, worse filtering; recommend the same termination+bound there.",
  "recommended_fix": "Initialize name[512] = { 0 } (always terminated); bound the msg-string walk by bios_size (provided by DF-4337s atom_in_bios)",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff git apply --check OK; fixed-logic mirror gives strlen(name)=511 (terminated) and stops at the image end. Kernel-runtime validation impossible on this guest.",
  "fix_evidence": "fix.diff; DF-4337/fix_run.log name/name_nul fixed cases"
}