{
  "finding_id": "DF-4807",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ppiwrite() discards the uiomove() return (ppi.c:478) and hands the full len bytes of the kernel ppi_buffer to byte_peripheral_write regardless of how many were copied - the DF-4535 (lpt.c:763) twin on the 1284-peripheral side, proven in the module binary (objdump: uiomove call at 0x58e with %eax never tested before byte_peripheral_write at 0x5a0, whose rc IS tested at 0x5a8). The stale-byte transmission facet could not be exercised on the QEMU guest: reaching the data loop requires PPB_PERIPHERAL_IDLE, i.e. a remote IEEE1284 master host to complete the peripheral negotiation, and the SPP emulation provides none - the write demonstrably enters the driver and blocks in the negotiation wait (S3, wchan=ppiwrite, SIGKILL-killable via PCATCH; run.log). Confidence certain: the dropped check is in the shipped binary and the identical code shape was runtime-verified transmitting 133,120 stale bytes for lpt (DF-4535) on this same guest/port.",
  "exploit_chain": "",
  "evidence": "ppiwrite.dis (objdump -dr of the loaded module: uiomove rc dropped); run.log (write() blocks at ppi.c:459 S3/wchan=ppiwrite, SIGKILL_TERMINATED); README.md cross-reference to the DF-4535 evidence pack",
  "kernel_refs": [
    "sys/dev/misc/ppi/ppi.c:478",
    "sys/dev/misc/ppi/ppi.c:477",
    "sys/dev/misc/ppi/ppi.c:459",
    "sys/bus/ppbus/ppb_1284.c:389",
    "sys/dev/misc/lpt/lpt.c:763"
  ],
  "poc_changes": "PoC authored fresh (no seed); note signal(3) installs SA_RESTART on DF so a caught signal restarts the blocked write - the block/kill demo must use SIGKILL.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "cc -O -Wall -o ppiwrite_uio ppiwrite_uio.c",
  "run_cmd": "./ppiwrite_uio & ; ps ax -o pid,stat,wchan,comm | grep ppiw ; pkill -9 ppiwrite_uio",
  "code_hash": "49b53b2a2045d717ab88bf59c063cf17c0fdf7e02594b52c3efcdaba672ea3f8",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "End-to-end fix validation requires IEEE1284 master-peer hardware (absent on the QEMU guest); the proposed check-and-bail is identical to the fix validated for DF-4535.",
  "fix_evidence": "VERDICT.md Fix section",
  "notes": "Requires options PERIPH_1284 (LINT64-only) and /dev/ppi0 (0600 root:wheel, verified on guest).",
  "recommended_fix": "Check the uiomove() return at ppi.c:478 and goto error on failure (same check-and-bail as the validated DF-4535 fix)."
}