{
  "finding_id": "DF-5336",
  "status": "reproduced",
  "reproduced": true,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Reproduced 3/3 on the stock guest kernel: db_disasms Grp7 mod==3 dispatch (db_disasm.c:1275) indexes the 2/4/5/7-entry db_Grp7_11_* sub-tables with the unbounded rm field (regmodrm & 0x7), reading a const char* from adjacent kernel .rodata and printing it via db_printf %s (:1303). Plain 0f 01 c5/cc/d7/ea/ef (no REX) printed (null)-padding, a foreign-table pointer, and the WRONG-TABLE mnemonics xgetbv/xend (db_Grp7_11_010[0]/[5], adjacency proven by nm: _111 ends exactly where _010 begins). Deterministic disclosure of adjacent .rodata to the DDB console; layout-dependent wild-deref potential if the adjacent qword is a non-pointer. Distinct index and trigger from known DF-1032 (outer f_reg), DF-1033 (REX.R), DF-2360 (NULL rows/REX wild). fix.diff (pad sub-tables to 8 + bound outer index/NULL-check) validated in-guest: quickkernel+installkernel+reboot, identical PoC prints empty for all OOB vectors with controls unchanged.",
  "exploit_chain": "attacker-influenced kernel memory containing 0f 01 ea..ef (or c5-c7/cc-cf/d7) reaches db_disasm via panic-backtrace auto-disassembly (db_print_loc_and_inst) or x/i at the db> prompt -> mod==3 Grp7 dispatch -> rm-field index past sub-table -> OOB const char* read from adjacent .rodata -> db_printf %s discloses its content (cross-table entries / raw pointer bytes / padding) on the console",
  "evidence": "run.log run.2.log run.3.log (stock kernel, 3 identical runs: OOB lines show (null), empty, xgetbv, xend; CTRL lines correct); env.txt (nm -n excerpt: db_Grp7_11_111 @0xffffffff80d9d330 +16 == db_Grp7_11_010 @0xffffffff80d9d340, byte-explaining xgetbv/xend); run.patched.log (all OOB vectors empty, controls unchanged); fix_build.log (KERNEL_FIX_BUILD_OK)",
  "kernel_refs": [
    "sys/cpu/x86_64/misc/db_disasm.c:1275",
    "sys/cpu/x86_64/misc/db_disasm.c:174-211",
    "sys/cpu/x86_64/misc/db_disasm.c:1303",
    "sys/ddb/db_examine.c:259"
  ],
  "poc_changes": "No seed existed; KLD authored fresh (calls global db_disasm() declared in ddb/ddb.h:93 on static byte vectors with kprintf banners; db_printf output observed on serial console via vm.sh log)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2820,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df5336 && env SYSDIR=/usr/src/sys make",
  "run_cmd": "kldload ./df5336_oob.ko; sleep 1; kldunload df5336_oob",
  "code_hash": "fa9d2faf81188533d640d4a30d5284b6120428cae7ec3ca929b12f7344dc7ca4",
  "notes": "DragonFly kvprintf renders NULL %s as (null) so the zero-padding reads do not crash on this build; the wild-deref variant needs a linker layout where the adjacent qword is a non-pointer. Reachability is DDB-gated (console/serial or in-kernel Debugger event), consistent with Low severity and with the known DF-1032/DF-2360 precedents. fix.diff also incidentally bounds the outer index (f_reg>5) and NULL-checks rows 3/4 of db_Grp7_11, hardening DF-1032/DF-2360 on this line. Guest was reset to the clean with-src snapshot after validation.",
  "recommended_fix": "Pad db_Grp7_11_{000,001,010,111} to 8 entries and bound/NULL-check the outer index in the mod==3 Grp7 dispatch (see fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "fixed",
  "fix_evidence": "run.patched.log: after git apply fix.diff + quickkernel + installkernel + reboot, the identical PoC prints empty for all 6 OOB vectors (baseline xgetbv/xend/(null)/empty gone) while all 5 in-bounds controls (vmxoff/monitor/xtest/swapgs/rdtscp) are unchanged"
}