{"finding_id":"DF-4993","status":"untested","attempts":0,"reproduced":0,"impact":"none","confidence":"certain","verdict":"Silent truncation, root-gated (Info): wcount clamped to [0,1024] but the SMBUS_BWRITE count param is u_char - 256->0, 300->44, 1024->0 bytes transmitted while the ioctl returns success (the header advertises the 1024 limit). Shortens only; no memory unsafety. Clamp-to-255 fix (or E2BIG).","exploit_chain":"SMB_BWRITE wcount=1024 -> 0 bytes on the wire, returns 0","evidence":"findings/poc/DF-4993/ (this verdict)","kernel_refs":["sys/dev/smbus/smb/smb.c:305-315","sys/bus/smbus/smbus_if.m:135-141"],"guest_uname":"","code_hash":""}