{
  "finding_id": "DF-5326",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Defect is certain at code level and its arithmetic is proven on the audited guest: mp_bootaddress() (sys/platform/pc64/x86_64/mp_machdep.c:206-219) performs unchecked u_int arithmetic on the firmware/loader-supplied size of the first usable memory region; for basemem <= 12 KB, mptramp_pagetables = boot_address - 3*PAGE_SIZE wraps to 0xFFFFC000-0xFFFFF000 and is stored into physmap[1] (machdep.c:2272), making the kernel treat the whole low 4GB (incl. MMIO/ROM holes) as usable RAM; for basemem 13-16 KB it returns 0 so the AP trampoline page tables (mp_machdep.c:414-438) are written over the real-mode IVT/BDA at PA 0. The verbatim-logic reproducer, parameterized with the real bootMP_size (170 bytes) from the guest kernel symbols, was compiled with the guest cc and produced exactly the predicted wrap/zero/sane table (run.log). The end-to-end kernel-boot manifestation is UNTESTED: arming it requires a crafted SMAP (first usable region ending below ~17 KB), which stock QEMU/SeaBIOS cannot express (etc/e820 fw_cfg only adds reserved regions) and which no unprivileged in-guest actor can influence. Low severity, boot-time only, malicious-firmware/boot-chain threat class (same as accepted DF-1034).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5326/run.log \u2014 guest-compiled reproducer output: basemem 0/1/2/4/8/9/12 -> 0xffffc000..0xfffff000 (WRAPPED), 13-16 -> 0x00000000 (PTs at PA 0), 17/32/638 -> sane; the 638 KB row equals the real SeaBIOS basemem on this guest. VERDICT.md section 1 traces basemem from physmap[1] (machdep.c:2270) through the wrap and back into physmap[1] (machdep.c:2272); fix.diff applies cleanly (git apply --check).",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/mp_machdep.c:206",
    "sys/platform/pc64/x86_64/mp_machdep.c:212",
    "sys/platform/pc64/x86_64/mp_machdep.c:213",
    "sys/platform/pc64/x86_64/mp_machdep.c:216",
    "sys/platform/pc64/x86_64/mp_machdep.c:414",
    "sys/platform/pc64/x86_64/machdep.c:2270",
    "sys/platform/pc64/x86_64/machdep.c:2272"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch. Reproducer copies mp_bootaddress() verbatim (u_int wrap semantics preserved) and parameterizes bootMP_size with the real value (mptramp_end-mptramp_start = 170) taken from the running guest kernels symbols.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "guest: echo <b64-of-mp_bootaddr_underflow.c> | openssl base64 -d -A > /tmp/mpb.c && cc -O2 -Wall -Wextra -o /tmp/mpb /tmp/mpb.c",
  "run_cmd": "guest: /tmp/mpb   (host equivalent: cc -O2 -o mp_bootaddr_underflow mp_bootaddr_underflow.c && ./mp_bootaddr_underflow)",
  "code_hash": "9733a54d7c9faf760a695e3adbabb0e1bb6dbec1ce9d01b603e8a28f4209ef81",
  "notes": "Guest verification of the kernel-boot consequence skipped per contract (Low severity, firmware-gated): the trigger needs loader-supplied SMAP control unavailable on the standard QEMU/SeaBIOS guest (see VERDICT.md section 3 for the full feasibility analysis, incl. the theoretical >=4TB u_int truncation variant). Guest left clean (only /tmp scratch, removed). Cross-file context: the pre-clamp unbounded MADT/x2APIC enumeration writes are already filed as DF-1064 (acpi_madt.c) and DF-1042 (lapic.c) and were NOT re-reported; this finding is the remaining unguarded firmware->kernel value in mp_machdep.c itself. Negative results (classes hunted and killed) are recorded in the pass-2 task_log entry and the result block.",
  "recommended_fix": "panic() in mp_bootaddress() when basemem*1024 < bootMP_size + 4*PAGE_SIZE (fail fast on degenerate firmware memory map) \u2014 see fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (boot-time panic on degenerate basemem, mirroring the trees existing panics on malformed firmware tables) is authored against the read-only sys/ tree and passes git apply --check, but could not be kernel-build-validated: the bugs kernel manifestation cannot be armed on this guest (needs crafted SMAP), so there is no baseline to compare a patched kernel against.",
  "fix_evidence": "findings/poc/DF-5326/fix.diff (git apply --check -p1 passes); reasoning in VERDICT.md section 5"
}