{
  "finding_id": "DF-4905",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Code-level defect is certain: after matching an AMDK7PNOW! signature, the PST walk (powernow.c:187-198) advances p by sizeof(pst)+2*n_states for psb->n_pst iterations with no bounds check against BIOS_START+BIOS_LEN; a corrupt/hostile PSB walks up to ~132KB past 0x100000 into the kernel physical load region (BIOS_PADDRTOVADDR(x)=x+KERNBASE, bios.h:36) and parses kernel text/data as PST headers. If stray bytes match cpuid/fid/vid, k8pnow_decode_pst() is handed an in-kernel pointer whose n_states is bounded only by the known DF-1961 missing check. Direct impact requires BIOS/firmware control under an AMD K8 CPU (same trust boundary as the known DF-1960/1961 family); the audit guest is Intel/QEMU and the module gate refuses at CPUID (MOD_LOAD error 2, env.txt), so runtime verification was impossible.",
  "exploit_chain": "",
  "evidence": "README.md (walk arithmetic + window math), env.txt (gate refusal), VERDICT.md",
  "kernel_refs": ["sys/dev/powermng/powernow/powernow.c:174", "sys/dev/powermng/powernow/powernow.c:187", "sys/dev/powermng/powernow/powernow.c:191", "sys/dev/powermng/powernow/powernow.c:196", "sys/platform/pc64/include/pc/bios.h:36"],
  "poc_changes": "Analysis-only pack; no harness (defect needs BIOS-memory control on K8 hardware to trigger).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not run (needs K8 + firmware control). fix.diff bounds the walk with two window checks (before the pst deref and before the decode call) and applies cleanly with patch(1).",
  "fix_evidence": "fix.diff: checking file powernow.c / DF4905_APPLIES_CLEAN",
  "recommended_fix": "Before each pst dereference and before invoking k8pnow_decode_pst, verify p + sizeof(struct pst_s) [+ 2*n_states] stays within BIOS_PADDRTOVADDR(BIOS_START+BIOS_LEN); bail (return 0) otherwise.",
  "notes": "Pass-2 sibling hardening of the DF-1960/DF-1961 BIOS-trust family; filed Low/speculative because no user-controlled input reaches the walk."
}