{
  "finding_id": "DF-4992",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Logic defect, root-gated (Info): all three read ioctls assign error=smbus_error(...) then immediately overwrite it with error=copyout(...) inside the rbuf branch - a failed/no-ACK transaction returns ioctl()==0 and the callers struct carries rdata untouched (fabricated data from the callers own input). Monitoring tools cannot distinguish failed reads. Short-circuit-on-error fix.",
  "exploit_chain": "failed SMB read -> ioctl success + stale rdata",
  "evidence": "findings/poc/DF-4992/ (this verdict)",
  "kernel_refs": [
    "sys/dev/smbus/smb/smb.c:272-303"
  ],
  "guest_uname": "",
  "code_hash": ""
}