# DF-5307 VERDICT

**Status: untested** (Low severity, read-only primitives — Phase V not
mandated), confidence: certain in the code defect, speculative in any
impact beyond the OOB read itself.

## Analysis

Four sites in the descriptor parsers read device-supplied fields
without first proving the descriptor is long enough to contain them
(see README.md for exact path:line and mechanics):

- XU `bControlSize` at `22 + bNrInPins` with `bNrInPins` unbounded by
  `bLength` — up to 253 bytes past the descriptor (uvc_drv.c:2332-2334);
- IT `bControlSize` at offset 14 before validation (uvc_drv.c:2209);
- VC header `bIfaceList[0]` at offset 12 when `bLength == 12`
  (uvc_drv.c:2109-2124);
- VS_COLORFORMAT `bColorPris` at offset 3 (uvc_drv.c:1843-1845).

Each over-read stays inside the cdesc allocation unless the descriptor
sits at the end of the blob, in which case it is a kernel heap OOB
read.  I traced every consumer of the four values: they feed either a
comparison that rejects the descriptor (XU, IT, VC) or a colorspace
table index bounded by `nitems()` (COLORFORMAT) — **no value reaches
userspace**, so this is hardening/defense-in-depth (CWE-125 read) with
no demonstrated disclosure.  The XU traversal is additionally fragile:
any future code change that *uses* `ctrls_mask_size` from the over-read
before validation would turn it into a heap-info leak.

## Why untested

The QEMU harness built for DF-5305/DF-5306 exercises the parse paths
but was not extended to trigger these specific malformed shapes; Low
severity places them below the Phase V mandate.  The fix.diff guards
were compiled during the DF-5306 fix validation (the VC-header guard is
on the exercised path); the XU/IT/COLORFORMAT guards are compile-checked
only.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.