{
  "finding_id": "DF-4385",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "oce_img_flashing_required (oce_sysctl.c:449-472) bcmps 4 bytes at fw->data + bin_offset + 262144 + 1048576 - 4 with no fw->datasize check, executing before the size gate at :389; a ~4KB cookie-valid hostile image makes the kernel read ~1.3MB past the firmware allocation. Sibling site missed by DF-1573 (which enumerated 257/263/265-273/297/322/515 only). Kernel-path run is hardware-gated (no 19a2: PCI device on guest, hw_probe.log); primitive proven by guard-page replica (SIGSEGV exit 139, run.log) and source trace. Root-only + hostile-file threat model: Low, defense-in-depth.",
  "exploit_chain": "",
  "evidence": "run.log (guest: read at +1310892 of 4096-byte image -> SIGSEGV), trigger.c (exact arithmetic replica), VERDICT.md (path:line trace), fix.diff (git apply --check OK, syntax-validated on guest toolchain)",
  "kernel_refs": [
    "sys/dev/netif/oce/oce_sysctl.c:334",
    "sys/dev/netif/oce/oce_sysctl.c:458",
    "sys/dev/netif/oce/oce_sysctl.c:460",
    "sys/dev/netif/oce/oce_sysctl.c:468",
    "sys/dev/netif/oce/oce_sysctl.c:389"
  ],
  "poc_changes": "n/a - pass-2 finding authored fresh; replica written for this pack",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o trigger trigger.c (guest cc 8.3)",
  "run_cmd": "./run.sh",
  "code_hash": "8a5fc827c8e601ab4709d13ea85da4c0fcdde724d51433b0f62106e8929e8980",
  "notes": "Status untested = target device absent on guest (contracts not_testable class). DF-1573 sibling-site exclusion respected.",
  "recommended_fix": "pass fw->datasize into oce_img_flashing_required and reject hdrs_size+img_offset+img_size > fw_datasize before the bcmp",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable at runtime (no oce NIC on guest); fix.diff (3 hunks) git-apply --check OK against pristine sys/ and syntax-validated with the guest kernel toolchain (0 errors).",
  "fix_evidence": "fix.diff; guest cc -fsyntax-only of patched oce_sysctl.c: 0 errors.",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64"
}