{
  "finding_id": "DF-4959",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Functional (Info; inherited from FreeBSD): the s blink-spec filter reads *s == U || *s <= u - the <= makes ANY char <= u (all control chars, digits, k-u, and via signed char every high-bit byte) pass as a no-op blink tick. Masks the simplest DF-4958 trigger. Interpreter branches all range-bounded - no memory-safety impact. One-character == fix (upstream too).",
  "exploit_chain": "none - functional filter semantics",
  "evidence": "findings/poc/DF-4959/ (this verdict)",
  "kernel_refs": [
    "sys/dev/misc/led/led.c:169-174"
  ],
  "guest_uname": "",
  "code_hash": ""
}