{
  "finding_id": "DF-4361",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "select_tuner() bounds-checks only the upper end (tuner_type < Bt848_MAX_TUNER) of the tuners[] dispatch index; a negative type would set bktr->card.tuner = &tuners[negative], dereferenced later for pllControl/bandAddrs and a %s name printout — a wild kernel read. Exhaustive caller enumeration (masked boot tunable, compile-time override undefined, constant signature/EEPROM tables) proves every current call site non-negative, so this is a defense-in-depth hardening finding (Info). Path additionally requires Brooktree PCI hardware, absent from the audit guest.",
  "exploit_chain": "",
  "evidence": "README.md (code excerpt bktr_tuner.c:709-715 + full caller enumeration with path:line); VERDICT.md; guest pciconf shows no 0x109e device",
  "kernel_refs": ["sys/dev/video/bktr/bktr_tuner.c:710", "sys/dev/video/bktr/bktr_tuner.c:825", "sys/dev/video/bktr/bktr_card.c:1343", "sys/dev/video/bktr/bktr_card.c:906", "sys/dev/video/bktr/bktr_os.c:470"],
  "poc_changes": "none — no PoC seed; static verification only (hardware-gated path)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding on sys/dev/video/bktr/bktr_tuner.c. PoC skipped per contract: Info/hardening + requires Brooktree hardware absent from QEMU guest (pciconf verified 2026-09-19). Not a re-report of DF-3783..3790 (those were bktr_core.c/bktr_os.c bugs).",
  "recommended_fix": "Add the missing lower bound in select_tuner: if (tuner_type >= 0 && tuner_type < Bt848_MAX_TUNER)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable — needs Brooktree PCI hardware; fix is a pure lower-bound addition with no behavior change for valid values",
  "fix_evidence": "fix diff in README.md"
}