{
  "finding_id": "DF-4876",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "afd_sense() hands three uninitialized stack structs to ata_atapicmd(); short-but-successful ATAPI data-in responses (normal underrun, not an error in the nata completion path, no zero-fill of request->data) leave heads/sectors/sector_size/cylinders past the only validated field (page_code) as stale kernel stack, which is then published as disk geometry — CWE-457 with a degraded stack-content leak via disk-info ioctls and garbage LBA math in afd_strategy. Verified hop-by-hop in source; not runnable because the guest cannot attach an ATAPI direct-access device.",
  "exploit_chain": "crafted ATAPI floppy returns short MODE SENSE(10)/READ_CAPACITY data with success status -> struct tail stays stale stack (atapi-fd.c:345-347, consumed at :383-384/:395-396/:406-410) -> garbage geometry via disk_setdiskinfo (atapi-fd.c:207-217) -> observable via DIOCG*-style disk info (weak kernel-stack leak) + misplaced raw I/O from afd_strategy LBA math",
  "evidence": "VERDICT.md (full trace incl. ata_atapicmd non-zeroing path); README.md; DF-4874/run.log (shared hardware blocker)",
  "kernel_refs": ["sys/dev/disk/nata/atapi-fd.c:345", "sys/dev/disk/nata/atapi-fd.c:346", "sys/dev/disk/nata/atapi-fd.c:347", "sys/dev/disk/nata/atapi-fd.c:379", "sys/dev/disk/nata/atapi-fd.c:390", "sys/dev/disk/nata/atapi-fd.c:403", "sys/dev/disk/nata/atapi-fd.c:405", "sys/dev/disk/nata/atapi-fd.c:406", "sys/dev/disk/nata/ata-queue.c:188"],
  "poc_changes": "n/a — source-trace finding; hardware blocker shared with DF-4874",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Short ATAPI data-in underrun is device-controlled; zero-valued garbage is already rejected by the !mediasize ENXIO guard (atapi-fd.c:204), so the known DF-1945 div0 sink is not reopened.",
  "recommended_fix": "bzero(&capacity)/(&capacity_big)/(&capabilities) before each ata_atapicmd in afd_sense()",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No afd hardware on guest; fix converts short responses into zeros which the existing !mediasize ENXIO path rejects",
  "fix_evidence": "fix.diff (git apply --check OK)"
}