{
  "finding_id": "DF-5147",
  "title": "dcons_load_buffer() trusts wire-supplied buffer geometry (sizes/offsets/24-bit pos) with an overflowable sum-only sanity check - latent OOB read/write primitive in dead-but-exported code",
  "severity": "Info",
  "bucket": "base:dev",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "root_cause": "sys/dev/misc/dcons/dcons.c:169-176,181,184-186",
  "sinks": ["sys/dev/misc/dcons/dcons.c:101", "sys/dev/misc/dcons/dcons.c:118"],
  "reachability": "none in-tree (rg: only definition dcons.c:158 + prototype dcons.h:105; live path uses dcons_init at dcons_os.c:453/464)",
  "reproduce": {
    "build": "n/a",
    "run": "n/a",
    "expected": "n/a - analysis-only hardening finding"
  },
  "kernel_refs": [
    "sys/dev/misc/dcons/dcons.c:158",
    "sys/dev/misc/dcons/dcons.c:169-176",
    "sys/dev/misc/dcons/dcons.c:181",
    "sys/dev/misc/dcons/dcons.c:184-186",
    "sys/dev/misc/dcons/dcons.c:101",
    "sys/dev/misc/dcons/dcons.c:118",
    "sys/dev/misc/dcons/dcons_os.c:453",
    "sys/dev/misc/dcons/dcons_os.c:464"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "fix.diff",
    "verdict.json",
    "manifest.json"
  ]
}