{
  "finding_id": "DF-4776",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain dead-code twin of DF-4746: am7990_start_locked calls lance_put with no LEBLEN clamp (lance.c:309-325 unbounded chain memcpy) and tmd.tmd2=-len arms a twos-complement length. Dead code (no am7990_config caller); even live, the overrun stays within/past the dedicated bus_dmamem shared region and the only >LEBLEN injection vector is root-only BPF write. Defense-in-depth pkthdr.len guard fix.",
  "exploit_chain": "n/a (dead code + root-only vector)",
  "evidence": "findings/poc/DF-4776/ (this verdict)",
  "kernel_refs": [
    "sys/dev/netif/lnc/am7990.c:523",
    "sys/dev/netif/lnc/lance.c:313-319"
  ],
  "guest_uname": "",
  "code_hash": ""
}