{
  "finding_id": "DF-5117",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect is certain: dmamap_cb (dcons_crom.c:126-153) prints a bus_dmamap_load error but does not return - DFs bus_dmamap_load invokes the callback even on failure (busdma_machdep.c:804) with segments[] backed by uninitialized stack (cache_segments, :771) - so the callback stores garbage into sc->bus_addr, prints those 8 uninitialized kernel-stack bytes to the console (dcons_crom.c:137-138), wires dcons_conf->dma_tag/dma_map for a failed map (:144-145), and publishes the garbage as dcons_paddr into the local ConfigROM (post_busreset :120-121) for FireWire peers, while dcons_crom_attach (:171-185) ignores all three bus_dma return values and returns success. Practical reachability is ~nil on DF/amd64: bus_dmamap_load forces WAITOK (:782-783) over a valid contigmallocd buffer and the tag/map creation paths are M_INTWAIT - so this is filed as Info hardening, not a demonstrable leak.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-by-line continuation trace + busdma callback semantics); env.txt (no FireWire hardware on guest); trigger.sh documents the unreachable precondition",
  "kernel_refs": [
    "sys/dev/misc/dcons/dcons_crom.c:130",
    "sys/dev/misc/dcons/dcons_crom.c:134",
    "sys/dev/misc/dcons/dcons_crom.c:137",
    "sys/dev/misc/dcons/dcons_crom.c:146",
    "sys/dev/misc/dcons/dcons_crom.c:171",
    "sys/dev/misc/dcons/dcons_crom.c:182",
    "sys/platform/pc64/x86_64/busdma_machdep.c:804",
    "sys/platform/pc64/x86_64/busdma_machdep.c:771"
  ],
  "poc_changes": "n/a - precondition (load failure) unreachable on the guest (no FireWire controller) and on the platform (WAITOK forced)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "none",
  "run_cmd": "sh findings/poc/DF-5117/trigger.sh",
  "code_hash": "398cf0e7fc121e35aa512900dbe84b9619dd9fc7c9cf6cb0ac176de105361151",
  "notes": "status untested per orchestrator enum. Same family as DF-4781 (unchecked allocation in dcons_os.c) but distinct file/call sites. Fix makes dmamap_cb return on error and makes attach check/unwind the three bus_dma calls.",
  "recommended_fix": "dmamap_cb: return immediately on error before touching segments[] or the globals; dcons_crom_attach: check bus_dma_tag_create/bus_dmamap_create/bus_dmamap_load and fail attach with unwind.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff authored statically (error return in callback + checked/unwound attach); cannot be validated on this guest - no FireWire controller and the failure precondition is unreachable on DF/amd64 busdma.",
  "fix_evidence": "fix.diff; VERDICT.md"
}