{
  "finding_id": "DF-5299",
  "status": "inconclusive",
  "verdict": "Source-verified defect: usbd_get_phys() (sys/bus/u4b/usb_device.c:2249-2258) casts the USB host controllers newbus ivars to struct pci_devinfo * with no bus-type or NULL check; on a non-PCI HCI (or one with no ivars) this is a NULL/wild deref -> panic at UVC attach, or a limited kernel-heap info leak into the V4L2 bus_info string copied to userspace (uvc_v4l2.c:132). Runtime verification is architecturally impossible on the x86-64 QEMU target (all HCIs are PCI; no UVC emulation), hence inconclusive rather than not_reproduced. The accompanying file-level soak (139,053 hostile ugen ioctls, 1,559 full config re-select cycles through usb_config_parse ALLOC/INIT/FREE + usb_cdev_create, 90 alt changes, 48 concurrent device replug cycles) produced no panic or corruption, weighting the pass-2 negative result for the rest of usb_device.c.",
  "reproduced": false,
  "impact": "none",
  "confidence": "speculative",
  "exploit_chain": "",
  "evidence": "VERDICT.md (root cause + kill list), usbsoak.c + run.log + run.2.log (soak: ops=70139/68914, no panic), env.txt (rig). Trigger needs non-PCI USB HCI + UVC device: absent on this target.",
  "kernel_refs": [
    "sys/bus/u4b/usb_device.c:2249",
    "sys/bus/u4b/usb_device.c:2255",
    "sys/bus/u4b/uvc/uvc_v4l2.c:132",
    "sys/bus/u4b/usb_device.c:2246"
  ],
  "poc_changes": "n/a \u2014 finding not runtime-triggerable on the PCI-only x86 rig; the soak harness was authored fresh (no seed PoC existed).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o usbsoak usbsoak.c",
  "run_cmd": "./usbsoak 424242  (concurrently with 48 QEMU-monitor replug cycles of the tablet device)",
  "code_hash": "c2454e8636132ac05ca89bbdc0104859368c7c1583f09144e698d666998148cd",
  "notes": "Pass-2 of sys/bus/u4b/usb_device.c. Known DF-1003/DF-1004/DF-1005 not re-reported; DF-1004s IN_USE continues zeroing variant deliberately treated as the same root cause. Second new finding DF-5300 (usbd_get_iface OOB-pointer-before-check, Info) needs no evidence pack. Guest was reset to snapshot with-src after the soak.",
  "recommended_fix": "Type-check/NULL-check the controller ivars in usbd_get_phys() before formatting the PCI tuple; fall back to a bus-unit-only prefix otherwise (diff in VERDICT.md).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix not buildable/testable: the buggy branch cannot be entered on the PCI-only x86 target, so no baseline behavior exists to compare against. Diff authored against the read-only sys/ tree only.",
  "fix_evidence": "VERDICT.md contains the git-apply-able fix.diff content; never applied to sys/."
}