# DF-4598 — VERDICT

**Status: untested** (Info-severity hardening finding; root/loader-input only,
no guest run).

## Analysis

`sys/dev/raid/vinum/vinumio.c:723` — the `has_slice >= 0 && has_part` branch
of `vinum_scandisk()` uses `strncpy(partname, devicename[driveno],
DRIVENAMELEN)` with `partname[64]`. A device path of ≥ 64 characters whose
basename matches the `%*[a-z]%*d%*[s]%d%c` scan shape (ksscanf, line 711)
yields an unterminated `partname`. The first consumer that treats it as a
C string is `find_drive_by_dev()`'s create path
(`ksnprintf(drive->devicename, sizeof(...), "%s", devname)`,
vinumconfig.c:534-536) — a stack overread whose length is bounded only by the
first accidental NUL. The copied bytes land in the new drive's
`devicename`, inspectable by the same root user. The `strcmp` in the search
loop terminates safely because the comparison operand is a NUL-terminated
≤63-byte devicename. No unprivileged path; recorded as Info.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)