{
 "finding_id": "DF-4704",
 "poc_id": "DF-4704",
 "status": "untested",
 "reproduced": 0,
 "impact": "Kernel page faults / adjacent-memory corruption on the first console clear at 8bpp KMS console (4-byte writes on a 1-byte stride); root/boot-config gated",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "get_pixel_size integer-divides depth/8: depths 8..15 return 1 while the blit/fill dispatch falls through to the 32-bit ops (writel 4 bytes/px) - each text row overruns its scanline by 3*width bytes and the last rows write past the fb mapping. fill_rect16/32 verified correct (no DF-1818 twin); the known 24-bit slow-path is the only other stride defect. Switch-return-0 + refuse-to-draw fix.",
 "kernel_refs": [
  "sys/dev/misc/syscons/sckmsrndr.c:138",
  "sys/dev/misc/syscons/sckmsrndr.c:142",
  "sys/dev/misc/syscons/sckmsrndr.c:389",
  "sys/dev/misc/syscons/sckmsrndr.c:482"
 ],
 "verdict": "not_run: boot-flag gated (video=...@8) and no drm KMS console on the QEMU guest; arithmetic source-certain",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: hardware/boot-flag gated",
 "fix_evidence": "fix in finding markdown"
}