# VERDICT — DF-5147

**Status: untested (Info-severity hardening finding — PoC skipped per audit
contract; no Critical/High actionability, no in-tree reachability).**

## Narrative

Pass-2 deep audit of `sys/dev/misc/dcons/dcons.c` (beyond known DF-2142 wire-pos
OOB read and the DF-4781/4782 dcons_os siblings) established:

1. **The live write path cannot be poisoned by a FireWire peer.**
   `dc->o.{size,pos,buf}` are set only by `dcons_init_port()`
   (dcons.c:138-141) from kernel-computed values derived from the fixed
   `DCONS_BUF_SIZE` = 16 KB (dcons_os.c:75-77); `optr[]` is written only by the
   kernel via `DCONS_MAKE_PTR` (dcons.c:124); the wire-controlled resync
   branches (dcons.c:67-68, 96-98) touch only `dc->i`. Hence the output ring
   cursor is confined to `[0, o.size)` and `dcons_putc`'s store at
   `ch->buf[ch->pos]` (dcons.c:118) is always in-bounds on every live path.
   The known DF-2142 covers the input-side OOB read.

2. **`dcons_load_buffer()` (dcons.c:157-191) is a certain latent memory-safety
   defect.** It adopts wire-format geometry (sizes, offsets, generation and
   24-bit positions) from the shared buffer header into the softc with a
   single "sanity check" that (a) never bounds `ooffset/ioffset` against
   `size` (dcons.c:171-172), (b) never checks `pos < size`
   (dcons.c:175-176), and (c) accumulates `s += dc->o.size + dc->i.size`
   (dcons.c:181) as `int` over u32 addends that wrap — e.g.
   `osize=isize=0x80000000` for both ports yields addend 0 and the check
   passes with 2 GB channel sizes. If any code ever calls it on a
   peer-writable buffer, `dcons_putc` (dcons.c:118) becomes a byte-wise
   kernel write at peer-chosen displacement (buf + u32 offset + 24-bit pos)
   and `dcons_checkc` (dcons.c:101) a peer-steered kernel read whose result
   is delivered to the console/gdb reader.

3. **Reachability today: none.** `rg -n 'dcons_load_buffer' sys/` finds only
   the definition (dcons.c:158) and the prototype (dcons.h:105). The DragonFly
   attach path always calls `dcons_init()` (dcons_os.c:453, 464). The function
   is still compiled into the `dcons` module and exported, one re-wiring away
   from the primitive above.

Because the defect is real at the code level but unreachable in this tree, it
is filed as **Info (hardening / latent OOB)**, confidence certain about the
defect itself, and no guest PoC was run (nothing observable — dead code).
`fix.diff` hardens the loader: 64-bit accumulation, offset+size bounds, and
`pos < size` per channel.

## Classes considered and killed (full-file sweep)

- OOB write via wire on `dc->o`: impossible live (see 1).
- `dcons_ischar` (dcons.c:47-73): dead code (no callers), identical resync
  defect to DF-2142 — already recorded in DF-2142's summary; not re-reported.
- Unlocked concurrent `dcons_putc` (console vs tty drain): unsynchronized
  `ch->pos++` can drop/duplicate console bytes; both racers store `N+1`
  (never `N+2`), aligned u32 `*ch->ptr` store is atomic → console-stream
  corruption only, no memory-safety consequence.
- `dcons_init`/`dcons_init_port` arithmetic (dcons.c:136, 199-204): fixed
  16 KB input, port regions exactly tile `[DCONS_HEADER_SIZE, size)`, no
  overflow.
- Info leak via shared header: kernel stores only offsets/sizes/ptr-words in
  `struct dcons_buf`; no kernel pointers published from dcons.c (paddr
  publication is dcons_crom.c, tracked as DF-5116..5118).
- `dcons_checkc` wrap logic (dcons.c:102-106): `pos++` then `>= size` wrap —
  no off-by-one; `buf[size]` never touched on kernel-maintained cursors.

## Fix validation

not_testable — latent dead-code defect; the fix is hardening validated by
inspection. No baseline misbehavior exists to reproduce and no guest run was
performed for this finding (guest untouched).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.