{
  "finding_id": "DF-4875",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "afd_describe() ksprintfs a device-controlled u64 media size into char sizestring[16]; mediasize from READ_CAPACITY (up to (2^32-1)^2) or READ_CAPACITY_16 (arbitrary u64, wraps) renders up to 17592186044415MB = 17 bytes incl NUL \u2014 a deterministic 1-byte NUL stack overflow at attach. Proven by exact arithmetic (proof.txt) on both capacity paths; in-situ run blocked only by the absence of ATAPI direct-access hardware under QEMU 7.2.",
  "exploit_chain": "crafted/buggy ATAPI floppy answers READ_CAPACITY with capacity=blocksize=0xFFFFFFFF (or READ_CAPACITY_16 with huge capacity) -> mediasize >= 1.049e19 -> afd_attach -> afd_describe ksprintf writes 17 bytes into char[16] -> NUL lands on adjacent stack local (ch/atadev/fdp at atapi-fd.c:443-445) -> faulted deref in device_printf (attach-time panic); primitive limited to a fixed 0x00 byte",
  "evidence": "proof.txt (exact 17>16 for both paths, smallest trigger value); VERDICT.md; DF-4874/run.log for the shared hardware blocker",
  "kernel_refs": [
    "sys/dev/disk/nata/atapi-fd.c:446",
    "sys/dev/disk/nata/atapi-fd.c:448",
    "sys/dev/disk/nata/atapi-fd.c:449",
    "sys/dev/disk/nata/atapi-fd.c:384",
    "sys/dev/disk/nata/atapi-fd.c:396",
    "sys/dev/disk/nata/atapi-fd.c:130"
  ],
  "poc_changes": "proof.c generated fresh; no seed existed",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o proof4875 proof.c (host)",
  "run_cmd": "./proof4875",
  "code_hash": "5800145807574bddd7209945cd365b06ee7115459bb47970a1d531cb8293931a",
  "notes": "Overflow magnitude is a mathematical fact (17 bytes max render vs 16-byte buffer); runtime could only reveal which stack slot receives the NUL.",
  "recommended_fix": "char sizestring[32] + ksnprintf(sizestring, sizeof(sizestring), ...) for all three branches",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No afd hardware on guest for an A/B run; fix removes the overflow by construction (bounded formatter, 32-byte buffer > 17-byte worst case)",
  "fix_evidence": "fix.diff (git apply --check OK)"
}