# DF-4889

**iir_pci_attach maps BAR0 and immediately drives the i960 MPR register layout at fixed offsets
0x002c..0x3FC0 (magic write/read at 0x1000 at iir_pci.c:223-231, 0x2FC0-byte region clear at
iir_pci.c:232-233) without ever checking `rman_get_size(io) >= GDT_PCINEW_SZ` (0x4000). A card
with the probed IDs (0x8086:0x0600 / ICP 0x1119 range) but a short BAR0 → MMIO reads/writes past
the resource mapping: panic, or a bulk zero-write of up to ~12KB into kernel memory following the
mapping — before the magic read-back check can reject the card.**

Hardware-gated finding — PoC not runnable on the audit guest (no such controller; `pciconf -lv`
shows no 0x8086:0x0600 / 0x1119 device — see `env.txt`). Driver is compiled into the guest kernel
(`kldstat -v` → `100 pci/iir`), so the code path is live wherever the card exists.

Status: **untested** per the DF-4175 hardware-gated convention; the missing check is certain by
inspection. Source citations in the pass-2 result block; full narrative in `VERDICT.md`; fix in
`fix.diff` (size check right after `bus_alloc_resource_any`).