# DF-4377 — bktr_card.c probeCard() consumes uninitialized stack `eeprom[256]` when readEEProm() fails; uninitialized bytes reach console/dmesg

- **File:** `sys/dev/video/bktr/bktr_card.c`
- **Class:** CWE-457 (use of uninitialized memory) → kernel stack info disclosure to console/dmesg (kernleak, Low)
- **Pass:** 2 (GLM 5.3 re-audit)
- **Verdict:** `not_reproduced` — **hardware-gated**; the audit QEMU guest has no Bt848/878 card, so `/dev/bktr*` does not exist and the probe path cannot run (see `run.log`). The code defect itself is certain from source.

## What a maintainer needs to know

`probeCard()` declares `u_char eeprom[256]` on the kernel stack (bktr_card.c:605) and
passes it to `readEEProm()` **ignoring the return value** at four sites (:667, :794,
:1001, :1129). `readEEProm()` fills the buffer incrementally over the i2c bus and
returns `-1` on the first NAK — everything past the failure point (or the whole array)
stays uninitialized. probeCard then *derives identity data* from those bytes and prints
them:

- :668-674 → `subsystem_id`/`subsystem_vendor_id` from `eeprom[252..255]`;
- :676-678 → bootverbose `kprintf("subsystem 0x%04x 0x%04x")`;
- :757-758 → **unconditional** `kprintf("card vendor 0x%04x (model 0x%04x) unknown")`
  whenever the (garbage) vendor id is not in the table;
- :794-815 → Bt848 path: `eeprom[0..3]` compared, then **unconditionally** printed
  (`kprintf("%s: %x %x %x %x")`, :814-815) when unrecognized;
- :1001/:1004-1015 → Hauppauge re-parse reads `block_1[1..15]` of the same buffer
  (feeding the DF-1569 block walk with *uninitialized* offsets).

Impact: a handful of uninitialized kernel-stack bytes are disclosed to the console and
dmesg on every probe with a flaky EEPROM, and the card is misidentified
nondeterministically. Requires a Bt848/878 card whose EEPROM ACKs the probe read
(`locate_eeprom_address` succeeds) but NAKs the sequential data read — plausible
hardware behavior (that is exactly the failure `readEEProm` is written to detect).

Not re-reported (pass-1/known, filed from the ioctl side or sibling files):
DF-1569 (block_2/3 OOB), DF-3785 (BT848_REEPROM negative-offset heap overflow),
DF-3786 (BT848_SIGNATURE unbounded count), DF-1217 (raw I2C access),
DF-4361 (select_tuner bound), DF-2092 (same pattern in cxm_eeprom.c).

## Build / Run / Expected

```
build.sh   # on the DragonFly guest: cc -o chk_bktr chk_bktr.c
run.sh     # ./chk_bktr
```

Expected on hardware: probe output visible in dmesg; the uninit disclosure manifests
as the "subsystem 0x… / card vendor 0x… unknown / %x %x %x %x" lines carrying
stack garbage when the EEPROM read fails mid-way.

Observed on this guest (run.log): `DF-4377: /dev/bktr0 not present` → EXIT=2
(target device absent — probe cannot run).

## Fix

`fix.diff` — zero-initialize `eeprom[]` in `probeCard()` so a failed EEPROM read
yields deterministic (zero) vendor/model IDs instead of stack bytes.