{
 "finding_id": "DF-4443",
 "poc_id": "DF-4443",
 "status": "untested",
 "reproduced": 0,
 "impact": "Latent OOB write of softc state (rid ints + kernel pointers) past vtpci_intr_res[1+VIRTIO_MAX_VIRTQUEUES] for any child kmod requesting >9 vectors against a host advertising >=10 MSI-X vectors",
 "confidence": "certain",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "No unprivileged or in-tree path: all four in-tree children clamp cnt<=8. Requires privileged attacker-authored kmod + cooperating host. Defect certain by inspection (array bound :98-106 vs unclamped loop indices :484-514/:541-554; the in-function clamp :474-475 is to the host-controlled pci_msix_count).",
 "kernel_refs": [
  "sys/dev/virtual/virtio/pci/virtio_pci.c:460",
  "sys/dev/virtual/virtio/pci/virtio_pci.c:513",
  "sys/dev/virtual/virtio/pci/virtio_pci.c:541",
  "sys/dev/virtual/virtio/pci/virtio_pci.c:98"
 ],
 "verdict": "not_run: Low/hardening; needs out-of-tree kmod + malicious host; transport API-contract defect mirroring the nvqs guard the file already has",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable",
 "fix_evidence": "clamp *cnt to 1+VIRTIO_MAX_VIRTQUEUES at entry (finding markdown diff)"
}