{"finding_id":"DF-4990","status":"untested","attempts":0,"reproduced":0,"impact":"infoleak","confidence":"certain","verdict":"Latent stack OOB read, root-gated (Low): SMB_TRANS clamps the REQUESTED rcount to 1024 but smbus_trans overwrites s->rcount via actualp (driver-controlled) and the post-call value feeds copyout(buf,...,s->rcount) with NO re-clamp - buf is char[1024] on the kernel stack. The smb.c-side twin of the DF-4777 replylen family. Currently fenced: the only in-tree trans implementer (ig4) provably bounds *actualp<=requested; any future/bound-trusting backend immediately gets a stack OOB read. Re-clamp-before-copyout fix.","exploit_chain":"trans backend returning actual>1024 -> copyout reads past the 1024-byte kernel-stack buf into userspace","evidence":"findings/poc/DF-4990/ (this verdict)","kernel_refs":["sys/dev/smbus/smb/smb.c:333-349","sys/dev/smbus/smb/smb.c:211"],"guest_uname":"","code_hash":""}