{
  "finding_id": "DF-4982",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain OOB kernel-read primitive by source trace: iir_ctrl.c:325-332 writes event_data.size into USER memory, then gdt_store_event (iir.c:1875-1882) re-fetches evt->size three times and uses it as the memcmp length against the 16-byte eu union inside the 73.5KB static ebuffer[] — a racing thread flipping size to 0xFFFF yields up to ~65KB OOB comparison, with a merge-vs-append (same_count) equality oracle turning it into byte-wise kernel .data/.bss disclosure; the size==0 branch has the same flaw via unterminated strcmp on event_string[256]. Not runnable on the reference guest: the iir driver is compiled in but no ICP/Intel-0x600 RAID HBA exists, so /dev/iir is never created (verified, env.txt); additionally gated by the 0600 root-only device node, hence Low.",
  "exploit_chain": "seed ring via erase=0xff store (attacker source/idx) -> second 0xff ioctl with racer flipping event_data.size to 0xFFFF -> memcmp(ebuffer[elastidx].eu, user_buf, 0xFFFF) reads kernel bytes past the 16-byte union -> MERGE (same_count>=2) vs APPEND observable via erase=0 gdt_read_event -> learn byte k with <=256 guesses keeping learned prefix -> disclose ebuffer tail + adjacent module statics",
  "evidence": "VERDICT.md (full trace with iir.c/iir_ctrl.c line cites); env.txt (guest: /dev/iir absent, driver in-kernel, no 0x1119/0x600 PCI dev); df4982_iir_evt_oracle.c (runnable race+oracle PoC for HW-equipped hosts); fix.diff (copyin-once + clamp + copyout)",
  "kernel_refs": ["sys/dev/raid/iir/iir_ctrl.c:319", "sys/dev/raid/iir/iir_ctrl.c:326", "sys/dev/raid/iir/iir_ctrl.c:334", "sys/dev/raid/iir/iir.c:145", "sys/dev/raid/iir/iir.c:1875", "sys/dev/raid/iir/iir.c:1877", "sys/dev/raid/iir/iir.c:1879", "sys/dev/raid/iir/iir.c:1880", "sys/dev/raid/iir/iir.c:1883", "sys/dev/raid/iir/iir.h:515", "sys/dev/raid/iir/iir.h:546"],
  "poc_changes": "PoC authored fresh (no pass-1 seed): mirrors packed gdt_event_t layout, races only the 2-byte size field, observes merge via same_count on erase=0 read",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o df4982_iir_evt_oracle df4982_iir_evt_oracle.c",
  "run_cmd": "./df4982_iir_evt_oracle /dev/iir0",
  "code_hash": "",
  "notes": "Hardware-gated: /dev/iir requires an ICP vortex (0x1119) or Intel 0x600 RAID HBA (iir_pci probe) and is 0600 root:operator — verified absent on the audit guest (driver resident, node never created). Related known findings not re-reported: DF-2028 (GDT_IOCTL_GENERAL UAF of queued user buffer), DF-2029 (missing privilege check). Driver-internal gdt_store_event callers pass driver-sized &gdt->sc_dvr — unaffected.",
  "recommended_fix": "Copyin gdt_event_t once, clamp event_data.size to sizeof(eu), run the event helpers on the kernel copy, copyout on exit",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline not reproducible on available guest (no iir HBA -> no /dev/iir), so no A/B fix validation possible; fix.diff authored from line-accurate root cause and reviewed to close both the memcmp length race and the unterminated strcmp variant",
  "fix_evidence": "fix.diff (copyin/clamp/copyout) in this pack"
}