# DF-5307 — unvalidated descriptor-field reads in uvc_drv_parse_standard_ctrl()/uvc_drv_parse_data(): OOB reads up to 253 bytes past malformed descriptors

## Where (all in `sys/bus/u4b/uvc/uvc_drv.c`)

1. **Extension Unit (largest)** — `uvc_drv.c:2332-2334`:
   ```c
   src_ids_num = xu_desc->bLength >= 22 ? xu_desc->bNrInPins : 0;
   ctrls_mask_size = xu_desc->bLength >= 24 ?
       *(&xu_desc->bControlSize + src_ids_num) : 0;
   ```
   `bNrInPins` (offset 21, up to 255) is **not bounded by bLength**; the
   `bControlSize` byte is read at offset `22 + bNrInPins`, i.e. up to
   offset 277 of a descriptor whose `bLength` may be as small as 24 —
   up to **253 bytes past the descriptor end**, past the end of the
   `kmalloc()`ed cdesc buffer when the XU descriptor is last.  The
   value read is used for validation only (`bLength <
   ctrls_mask_size + src_ids_num + 24` → EINVAL), so no disclosure —
   but the kernel reads heap memory it must not read (and the traversal
   `*(&field + n)` is exactly the anti-pattern).
2. **Input Terminal** — `uvc_drv.c:2209`: `bControlSize` is read from
   offset 14 (`memcpy(&ctrls_mask_size, it_desc + 14, 1)`) *before* the
   `bLength < 15 + ctrls_mask_size` check at 2212; a camera-terminal
   descriptor with `bLength` 8..14 gives a 1..7-byte over-read.
3. **VC header** — `uvc_drv.c:2109-2124`: with `bLength == 12` and
   `vsnum == 1`, `bIfaceList[0]` is read at offset 12 — one byte past
   the descriptor.  (Same site as the DF-5306 acceptance bug; fixed
   together.)
4. **VS_COLORFORMAT** — `uvc_drv.c:1843-1845`: `cld->bColorPris` is
   read at offset 3 with no `bLength >= 4` check.

All four are read-only primitives with values consumed internally (no
path to userspace found), hence Low.  Same *class* as DF-2350/DF-5305
but distinct sites; the XU over-read is by far the largest reach.

## Fix

`fix.diff` (shared with DF-5305/DF-5306, applies with `git apply -p0`):
guards each read with the appropriate `bLength` check and clamps
`src_ids_num` to `bLength - 23`.  The VC-header guard was compiled and
exercised during the DF-5306 fix validation; the other guards are
compiled but not separately triggered (Low severity — not QEMU-verified
in this run; status `untested`).

## Files

    fix.diff   covers all four sites