{
 "finding_id": "DF-4626",
 "poc_id": "DF-4626",
 "status": "untested",
 "reproduced": 0,
 "impact": "Kernel crash DoS in the panel-enable path (mode_config mutex held); OOB bytes only steer skip offsets - no direct info disclosure",
 "confidence": "certain",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "Crafted-VBT walk unbounded until a zero byte: i2c/spi skip sizes (up to 262B) jump arbitrarily far; parse-time walkers partial, v3 sizes explicitly FIXME-unchecked. Distinct from DF-1771 (send_packet len) and DF-4123 (parse overread). Thread-the-end-pointer fix.",
 "kernel_refs": [
  "sys/dev/drm/i915/intel_dsi_vbt.c:444",
  "sys/dev/drm/i915/intel_dsi_vbt.c:458",
  "sys/dev/drm/i915/intel_dsi_vbt.c:362",
  "sys/dev/drm/i915/intel_dsi_vbt.c:369",
  "sys/dev/drm/i915/intel_dsi_vbt.c:194"
 ],
 "verdict": "not_run: no Intel GPU on guest; execution is the last line of defense and has no bound (vbt.dsi.size stored but never consumed)",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: hardware-gated (no Intel DSI panel / no mpt HBA on guest)",
 "fix_evidence": "fix in finding markdown"
}