{
  "finding_id": "DF-4978",
  "title": "SSIF stores BMC-accumulated unclamped reply length - kernel-heap OOB read via IPMICTL_RECEIVE_MSG copyout (DF-4777/4948 shape, third transport)",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "dfbsd-qemu/vm.sh run_root 'sh /root/ssifshock/build.sh'",
    "run": "phase1: kldload /root/ssifshock/ssifshock.ko (dmesg: ir_replylen=16023 over 1024); phase2: QEMU_EXTRA='-device ipmi-bmc-sim,id=bmc0 -device isa-ipmi-kcs,bmc=bmc0' boot, kldload ipmi, pw groupmod operator -m maxx, kldload /root/bumpko/bumpko.ko, unpriv /tmp/leak in background, sysctl hw.bumpreplylen=16023",
    "expected": "producer: BUG DF-4978 REPRODUCED ir_replylen=16023/1024; sink 3/3: data_len=16024, 7159-7190 nonzero kernel bytes past 1024 (first 0x042e), kernel pointers + 426 neighbor markers; control (arm 200): 0 bytes beyond; after fix.diff: ir_replylen=1024, data_len=1025, 0 bytes beyond"
  },
  "kernel_refs": [
    "sys/dev/misc/ipmi/ipmi_ssif.c:304",
    "sys/dev/misc/ipmi/ipmi_ssif.c:294",
    "sys/dev/misc/ipmi/ipmi_ssif.c:240",
    "sys/dev/misc/ipmi/ipmi_ssif.c:291-293",
    "sys/dev/misc/ipmi/ipmi_ssif.c:297",
    "sys/dev/misc/ipmi/ipmi.c:448-468",
    "sys/dev/misc/ipmi/ipmi.c:401-403",
    "sys/dev/misc/ipmi/ipmi.c:534-546",
    "sys/sys/ipmi.h:35",
    "sys/dev/misc/ipmi/ipmivars.h:49"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "ssifshock.c", "ipmivars.h",
    "bus/smbus/smbconf.h", "dev/smbus/smb/smb.h", "smbus_if.h", "Makefile",
    "bumpko.c", "leak.c", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "run.3.log", "run.control.log",
    "fix.diff", "fix_build.log", "fix_run.log",
    "leak_sample.txt", "env.txt", "manifest.json", "verdict.json"
  ]
}