{
  "finding_id": "DF-5147",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain latent memory-safety defect with no in-tree reachability: dcons_load_buffer() (sys/dev/misc/dcons/dcons.c:157-191) bakes wire-supplied osize/isize/ooffset/ioffset and 24-bit positions into the dcons softc with a sanity check that never bounds offsets or pos and whose int s accumulation of u32 size pairs wraps (dcons.c:181, e.g. osize=isize=0x80000000 -> addend 0, check passes). If any future caller passes a FireWire-peer-writable buffer (the functions design intent), dcons_putc (dcons.c:118) becomes a byte-wise kernel write at peer-chosen displacement (buf + u32 offset + 24-bit pos, content = console stream) and dcons_checkc (dcons.c:101) a peer-steered kernel read delivered to the console/gdb reader. rg over sys/ shows zero callers today (only dcons.c:158 and dcons.h:105); the live path always uses dcons_init() (dcons_os.c:453,464) whose geometry is kernel-computed from the fixed 16KB DCONS_BUF_SIZE, and the live write channel dc->o cannot be poisoned by the wire (resync at dcons.c:67/96 touches only dc->i; optr is kernel-written only at dcons.c:124). Filed as Info hardening; PoC skipped per contract for Info severity - there is no observable misbehavior on any reachable path. fix.diff validates geometry with 64-bit math, offset+size bounds and pos<size per channel.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5147/README.md (defect mechanics + why Info); findings/poc/DF-5147/VERDICT.md (full narrative incl. write-side live-path kill and caller search); findings/poc/DF-5147/fix.diff (hardening). Decisive lines: sys/dev/misc/dcons/dcons.c:169-176 (unvalidated wire loads), :181 (wrapping accumulation), :184-186 (sum-only check), :101/:118 (read/write sinks), dcons_os.c:453+464 (live path uses dcons_init instead).",
  "kernel_refs": [
    "sys/dev/misc/dcons/dcons.c:158",
    "sys/dev/misc/dcons/dcons.c:169-176",
    "sys/dev/misc/dcons/dcons.c:181",
    "sys/dev/misc/dcons/dcons.c:184-186",
    "sys/dev/misc/dcons/dcons.c:101",
    "sys/dev/misc/dcons/dcons.c:118",
    "sys/dev/misc/dcons/dcons.c:138-141",
    "sys/dev/misc/dcons/dcons.c:124",
    "sys/dev/misc/dcons/dcons_os.c:453",
    "sys/dev/misc/dcons/dcons_os.c:464"
  ],
  "poc_changes": "none - no PoC authored; Info-severity hardening finding (dead code in-tree), guest not used",
  "attempts": 0,
  "guest_uname": "n/a (no guest run - Info finding, PoC skipped per contract)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Pass-2 (GLM 5.3) of sys/dev/misc/dcons/dcons.c. Known and NOT re-reported: DF-2142 (wire pos OOB read via resync at dcons.c:96-98, incl. dead dcons_ischar note), DF-4781/4782 (dcons_os siblings). Verified this pass: live output ring dc->o cannot be poisoned by a FireWire peer (kernel-only geometry + kernel-written optr) so dcons_putc is in-bounds on all live paths; concurrent unlocked putc only drops console bytes (both racers store N+1, never N+2); dcons_init/init_port arithmetic exact for 16KB. The load_buffer geometry defect is certain but dead code -> Info.",
  "recommended_fix": "Harden dcons_load_buffer: validate ooffset/ioffset+size against the buffer size with 64-bit arithmetic and require pos < size per channel (see findings/poc/DF-5147/fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: latent dead-code defect, no baseline misbehavior exists to observe on any in-tree path; fix.diff is inspection-validated hardening (bounds + uint64 accumulation + pos<size), never applied to the read-only sys/ tree.",
  "fix_evidence": "findings/poc/DF-5147/fix.diff; caller search rg -n dcons_load_buffer sys/ -> only sys/dev/misc/dcons/dcons.c:158 and sys/dev/misc/dcons/dcons.h:105."
}