{
  "finding_id": "DF-4415",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The unprivileged REACHABILITY of the atkbdc poll layer reproduced live: uid 1999 opened world-writable /dev/psm0, MOUSE_GETHWINFO returned the real PS/2 mouse (buttons=5 iftype=3 hwid=4), and 20x MOUSE_SETMODE drove psm -> send_aux_command -> wait_while_controller_busy/wait_for_aux_ack (worst 7.3ms on the healthy QEMU i8042) - see run.log. The DEFECT itself (unbounded loops when the controller floods data: empty_kbd_buffer :865-882, empty_aux_buffer :905-922, read_kbd_data_no_wait :799-804, read_aux_data_no_wait :838-843 - none carries the waited cap that empty_both_buffers :959-966 has for exactly this scenario) cannot be exercised from guest userspace: injecting an i8042 data flood needs hardware/host-level access (/dev/io is root-only). Hardware-preconditioned local DoS (Low).",
  "exploit_chain": "",
  "evidence": "run.log (unpriv reachability reproduced); VERDICT.md (four uncapped loops vs the capped sibling); dmesg in env.txt (atkbdc0/psm0 present)",
  "kernel_refs": [
    "sys/dev/misc/kbd/atkbdc.c:865",
    "sys/dev/misc/kbd/atkbdc.c:905",
    "sys/dev/misc/kbd/atkbdc.c:799",
    "sys/dev/misc/kbd/atkbdc.c:838",
    "sys/dev/misc/kbd/atkbdc.c:959"
  ],
  "poc_changes": "MOUSE_GETINFO/mouseinfo_t (FreeBSD-isms) -> MOUSE_GETHWINFO/mousehw_t per DFly sys/mouse.h",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 8,
  "guest_dirty": 1,
  "build_cmd": "cc -O2 -Wall -o /tmp/psm_reach DF-4415/psm_reach.c",
  "run_cmd": "su -m audtx -c /tmp/psm_reach",
  "code_hash": "6535a78485447af58d44b26de42ff335da273e230b2f817c43292ab11c0eee3a",
  "notes": "Reachability part reproduced (uid 1999 -> atkbdc layer via /dev/psm0 0666); flood part requires malicious EC / VM-host i8042 model. /dev/kbd0,/dev/kbd1 are root-only, so the keyboard-side loops are less exposed than the psm side.",
  "recommended_fix": "Port empty_both_buffers overall waited cap to empty_kbd_buffer/empty_aux_buffer and bound the read_*_no_wait drain loops",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation not meaningful on this guest: the unbounded behavior needs a controller data flood that guest userspace cannot inject; a patched-kernel build would show no behavioral difference.",
  "fix_evidence": "fix.diff (waited caps + bounded drains)"
}