{
  "finding_id": "DF-4991",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "Uninit-input, root-gated (Low): SMB_BREAD declares u_char bcount UNINITIALIZED and passes &bcount as the smbus_bread count (an in/out param) - the hardware transfer length is a leaked stack byte (ichsmb gates the whole op on it and writes it to ICH_D0; ig4 reads it as rcount) while the users clamped rcount influences only the copyout bound, never the transaction. Nondeterministic lengths + a mini oracle on prior stack contents. No OOB on in-tree backends. Seed-bcount-from-rcount fix.",
  "exploit_chain": "uninit bcount -> ichsmb EINVAL-or-transfer branch on stack garbage; length observable",
  "evidence": "findings/poc/DF-4991/ (this verdict)",
  "kernel_refs": [
    "sys/dev/smbus/smb/smb.c:217",
    "sys/dev/smbus/smb/smb.c:319-329",
    "sys/bus/smbus/ichsmb/ichsmb.c:424-436"
  ],
  "guest_uname": "",
  "code_hash": ""
}