{
  "finding_id": "DF-5197",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "warp_saver() ignores the return of set_video_mode(adp, M_VGA_CG320) (warp_saver.c:87). vga_set_mode() (vga.c:997) can fail via prologue(ENODEV)/get_info(EINVAL) and returns before update_adapter_info(), leaving adp->va_window describing the 32KB text window (0xB8000/0x8000, vgareg.h:37-38). On that path warp_saver captures vid=adp->va_window (:93) and bzero()s 64000 bytes (:95) \u2014 32,000 bytes past the text window into 0xC0000+ (video-BIOS ROM shadow) \u2014 and every warp_update() tick then writes star pixels into the stale window. Exact twin of DF-5114 (dragon_saver.c:194). Latent: warp_init() already validated get_mode_info(M_VGA_CG320)==0 at load (:114-117) and vga_set_mode re-runs the same check, so no in-tree path produces the failure between load and first blank. Info severity to match DF-5114; guest PoC skipped per contract (Low/Info hardening) \u2014 a reproducible trigger does not exist in the unmodified tree.",
  "exploit_chain": "",
  "evidence": "warp_saver.c:87 (ignored return), :93 (vid capture), :95 (bzero 64000); vga.c:997-1005 (failure paths return before update_adapter_info at :581); vgareg.h:37-38 (CGA_BUF 0xB8000/32KB) vs :43-44 (GRAPHICS_BUF 0xA0000/64KB); twin: dragon_saver.c:194 (DF-5114); consumer that would absorb the fix: syscons.c:2564-2567 (splash EAGAIN handling)",
  "kernel_refs": [
    "sys/dev/misc/syscons/warp/warp_saver.c:87",
    "sys/dev/misc/syscons/warp/warp_saver.c:93",
    "sys/dev/misc/syscons/warp/warp_saver.c:95",
    "sys/dev/video/fb/vga.c:997",
    "sys/dev/video/fb/vga.c:581",
    "sys/dev/video/fb/vgareg.h:37",
    "sys/dev/misc/syscons/dragon/dragon_saver.c:194"
  ],
  "poc_changes": "n/a \u2014 no PoC built: the failure path has no in-tree producer after a successful init-time get_mode_info; forcing it would require patching the kernel under test.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Graded Info to match the pass-1 grading of its twin DF-5114. If an in-tree failure producer ever appears (adapter hot-unplug while saver armed), the bzero overruns 32KB into the 0xC0000 ROM-shadow region \u2014 panic-or-noop depending on platform. Guest inspected read-only; not dirtied.",
  "recommended_fix": "warp_saver.c:87: check set_video_mode() return; on failure return EAGAIN before capturing vid/blanked (scsplash_saver already retries on EAGAIN, syscons.c:2564-2567).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not applicable: no reproducible baseline exists in the unmodified tree (latent trigger); the 4-line fix is inspection-verified against the existing EAGAIN retry path in scsplash_saver().",
  "fix_evidence": "See README.md Fix section for the diff and the syscons.c:2564-267 EAGAIN consumer citation."
}