{
  "finding_id": "DF-5156",
  "status": "not_reproduced",
  "verdict": "The missing sc->rnum < MAX_ROMS bound in orm_identify() (orm.c:104-150, writes at orm.c:146-147) is real code but unreachable on every supported DragonFly platform: the only ISA implementation (sys/bus/isa/x86_64/isa.c; platforms pc64+vkernel64) silently rejects SYS_RES_MEMORY rids >= ISA_NMEM(8) in isa_set_resource (isa_common.c:897-899), and orm ignores bus_set_resources return value, so rnum can never exceed 8 < 16. Verified empirically: a crafted option ROM injected via QEMU -option-rom placed 48 valid 55 AA signatures in the ISA hole (verified present in RAM at 0xcb800/0xcf800/0xe2800); the driver recorded exactly 8 regions (devinfo + dmesg, 2 boots) and the guest stayed healthy. No OOB write, no panic. Filed as Info defense-in-depth: the latent heap overflow becomes live if ISA_NMEM is ever raised above MAX_ROMS (two constants in different files with no tie between them).",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "run.log/run.2.log: dmesg orm0: <ISA Option ROMs> at iomem 0xcb800-...-0xcf7ff = exactly 8 regions + /dev/mem dump proving 55 aa 04 cb headers exist at 0xcb800, 0xcf800 (9th, unrecorded) and 0xe2800 (47th, unrecorded); VERDICT.md: line-by-line containment trace (isa_set_resource isa_common.c:897-899 -> resource_list_alloc subr_bus.c:2693-2695 returns 0 -> orm.c:141-144 silent skip); seabios-attempts.txt: the two failed PoC iterations and why.",
  "kernel_refs": [
    "sys/dev/misc/orm/orm.c:104",
    "sys/dev/misc/orm/orm.c:136",
    "sys/dev/misc/orm/orm.c:146",
    "sys/bus/isa/isa_common.c:897",
    "sys/kern/subr_bus.c:2693",
    "sys/bus/isa/isavar.h:64"
  ],
  "poc_changes": "Authored the PoC from scratch (pass 1 filed nothing): learned (1) QEMU >=7.2 spells it -option-rom, (2) SeaBIOS enters ISA ROMs at seg:0003 regardless of the init vector at offset 3 - every 2KB block needs an immediate RETF (0xCB) or the zero body gets executed and the machine hangs pre-boot, (3) the outer size byte must have granularity != 0 (mod 4) so the orm scan itself skips the base while SeaBIOS still copies the whole file, (4) the option ROM must fit the ~120KB SeaBIOS window or it is silently not copied.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "python3 gen_orm_rom.py   # generates orm-evil.rom (97280 bytes, 47 fake headers)",
  "run_cmd": "cd dfbsd-qemu && QEMU_EXTRA=\"-option-rom <pack>/orm-evil.rom\" ./vm.sh up; ./vm.sh run_root dmesg | grep -i orm; devinfo -r | sed -n \"/^orm0/,/^$/p\"",
  "code_hash": "cfad77c9d105b1fed6de873a5dd9ba2877c12b674e1eff5d8f038102ed9cbd9a",
  "notes": "Containment constants: ISA_NMEM=8 (isavar.h:64) < MAX_ROMS=16 (orm.c:56). Also killed the zero-size-header infinite-loop theory: resource_list_alloc clamps count to ulmax(1,0)=1 (subr_bus.c:2690-2691), so a 55 AA 00 header yields one 1-byte region and the scan advances. Secondary hardening: a header near the top of the hole can reserve memory past IOMEM_END into RAM above 1MB (orm.c:137) - clamped in fix.diff. Guest was reset to the clean-source snapshot after the runs.",
  "recommended_fix": "Add explicit if (sc->rnum >= MAX_ROMS) break; at the top of the orm_identify scan loop and clamp rom_size to keep the reserved range inside the ISA hole.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix validation not performed: memory corruption did not reproduce (containment proven at runtime), so the mandatory rebuild-and-test cycle does not apply. fix.diff is a defense-in-depth bound check authored against the read-only sys/ tree and verified to apply cleanly with patch(1).",
  "fix_evidence": "n/a"
}