{
  "finding_id": "DF-4422",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "untested: Low-severity missing-bound hardening gap. draw_pxlcursor_direct/packed/planar (scvgarndr.c:789-791, 841-842, 890-891) compute (font_height - cursor_base - 1) without the cursor_base < font_height validation that the text-mode path performs at :236; a stale/larger cursor_base yields a negative font-buffer index (OOB read before scp->font) and a negative va_window offset (OOB write above the framebuffer mapping). The precondition (sc->cursor_base >= pixel-mode font_height) cannot be produced on this guest: sc->cursor_base is BIOS-derived (syscons.c:3372, bounded < boot font_height 16; QEMU SeaBIOS yields 0) and no ioctl sets it; only unusual firmware cursor_end values plus a smaller-font pixel mode can trip it. SC_PIXEL_MODE and the unprivileged CONS_CURSORTYPE ioctl path are compiled in and live (verified on the guest: opt_syscons.h SC_PIXEL_MODE=1, X86_64_GENERIC).",
  "exploit_chain": "",
  "evidence": "README.md trace; syscons.c:3183/3205 (imax(0,...) only), syscons.c:3371-3376 (BIOS-derived bound), scvgarndr.c:236 (the check the pixel paths lack).",
  "kernel_refs": ["sys/dev/misc/syscons/scvgarndr.c:789", "sys/dev/misc/syscons/scvgarndr.c:841", "sys/dev/misc/syscons/scvgarndr.c:890", "sys/dev/misc/syscons/scvgarndr.c:236"],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Defense-in-depth: add the same base >= font_height return that draw_txtcharcursor has, to all three pixel cursor draw functions.",
  "recommended_fix": "in vga_pxlcursor_direct/packed/planar: bail out when scp->cursor_base < 0 || scp->cursor_base >= scp->font_height (mirroring scvgarndr.c:236)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: precondition not constructible on this guest (BIOS-derived cursor_base = 0)",
  "fix_evidence": ""
}