# DF-4807 — ppiwrite() ignores the uiomove() return value: stale ppi_buffer bytes are handed to byte_peripheral_write() and a fully-faulting write never terminates (DF-4535 lpt twin, 1284-peripheral side)

File: `sys/dev/misc/ppi/ppi.c` line 478 (pass 2)

```c
	/* negotiation done, write bytes to master host */
	while ((len = (int)szmin(uio->uio_resid, BUFSIZE)) != 0) {
		uiomove(ppi->ppi_buffer, (size_t)len, uio);     /* rc DROPPED */
		if ((error = byte_peripheral_write(ppbus,
						ppi->ppi_buffer, len, &sent)))
			goto error;
	}
```

This is the exact DF-4535 shape (lpt.c:763, runtime-verified): a faulting
user buffer leaves the tail of the 512-byte kernel `ppi_buffer` stale
(previous write's data; probe-time zeros on first use), and
`byte_peripheral_write` transmits the full `len` bytes to the IEEE1284
master host. A fully-faulting uiomove (0 bytes copied) leaves
`uio_resid` unchanged, so the loop re-sends the stale chunk forever —
though unlike lpt's polled mode, this loop's exits are the wire handshake
timeouts in byte_peripheral_write (ppb_poll_bus PPB_FOREVER waits on the
remote master, PCATCH-interruptible) rather than an unkillable Giant-held
livelock.

## Reproduce boundary (honest status: not_reproduced for the leak facet)

The transmit loop (ppi.c:477) is only reachable after the local host
enters IEEE1284 **peripheral** mode — `PPB_PERIPHERAL_IDLE` — which
requires a remote **master** host to complete the 1284 negotiation
handshake (ppi.c:450-471). The QEMU guest's parallel port is an SPP-style
emulation with no 1284 master peer, so on this guest:

- `write()` demonstrably enters the path and blocks in the negotiation
  wait: process state `S3`, wchan `ppiwrite` (tsleep ppi.c:459, PCATCH),
  SIGKILL terminates it (`run.log`).
- The stale-byte transmission itself needs physical peer hardware.

What IS proven beyond the source line:

- the module binary drops the check — `objdump -dr` (`ppiwrite.dis`):
  `callq uiomove` at 0x58e/0x59e, return in `%eax` **never tested**, the
  very next call is `byte_peripheral_write` at 0x5a0 whose return IS
  tested (`test %eax,%eax; jne` at 0x5a8);
- the identical code shape was runtime-verified for lpt (DF-4535:
  133,120 stale bytes strobed out the port in IRQ mode on this same
  guest).

## Build / run (root, ppi.ko with PERIPH_1284 loaded)

```
cc -O -Wall -o ppiwrite_uio ppiwrite_uio.c
./ppiwrite_uio &      # blocks in the 1284 negotiation wait
ps ax -o pid,stat,wchan,comm | grep ppiw
kill -9 <pid>         # PCATCH: terminated
```

## Impact

Low: device node 0600 root:wheel + `options PERIPH_1284` (LINT64-only)
+ a physical 1284 master peer. Stale kernel-buffer bytes (not kernel
heap at large — ppi_buffer is only ever filled by uiomove/ppb_1284_read)
leave the machine over the parallel cable; a faulting write spins the
retransmit loop (bounded by wire timeouts, killable). Defense-in-depth:
check uiomove and bail.