{
  "finding_id": "DF-5307",
  "title": "Unvalidated descriptor-field reads in the UVC entity/CS parsers: OOB reads up to 253 bytes past malformed descriptors (XU bNrInPins, IT bControlSize, VC bIfaceList, VS_COLORFORMAT bColorPris)",
  "file": "sys/bus/u4b/uvc/uvc_drv.c",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "n/a (static analysis; harness not extended to these shapes)",
    "run": "n/a",
    "expected": "kernel reads at descriptor offsets not covered by bLength (heap OOB read when descriptor is last in cdesc)"
  },
  "kernel_refs": [
    "sys/bus/u4b/uvc/uvc_drv.c:2332",
    "sys/bus/u4b/uvc/uvc_drv.c:2209",
    "sys/bus/u4b/uvc/uvc_drv.c:2109",
    "sys/bus/u4b/uvc/uvc_drv.c:1843"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}