{"finding_id":"DF-4949","status":"untested","attempts":0,"reproduced":0,"impact":"dos","confidence":"likely","verdict":"Functional protocol defect (Low; no SMIC silicon on guest/QEMU): smic_read_byte writes the STATUS code SC_SMS_RD_NEXT (0xC5) into the control register where the COMMAND code CC_SMS_RD_NEXT (0x45) is required - every other transaction site in the file uses correct CC codes, making this an internal inconsistency (typo) inherited verbatim from FreeBSD ~19 years ago. On spec-compliant silicon every SMIC read fails (EIO storms, 3x retries, recovery only via wait_for_not_busy - feeding the DF-2003 hang class); a hostile BMC could interpret the stray opcode as a different command. One-token fix.","exploit_chain":"every SMIC reply byte -> out-of-spec 0xC5 control write -> BMC rejects/misinterprets -> read fails/retries/hang-feed","evidence":"findings/poc/DF-4949/ (this verdict)","kernel_refs":["sys/dev/misc/ipmi/ipmi_smic.c:202","sys/dev/misc/ipmi/ipmivars.h:175"],"guest_uname":"","code_hash":""}