{
  "finding_id": "DF-5353",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info-level functional defect reproduced on the guest: usb_temp_setup_by_index() (sys/bus/u4b/template/usb_template.c:1346-1373) has no USB_TEMP_PHONE case, so template index 7 (enum value advertised in sys/bus/u4b/usb_ioctl.h:56-67; template compiled into usb_template.ko per template/Makefile and nm) always returns USB_ERR_INVAL - the shipped phone gadget is dead code. Verified empirically: setup_by_index(7) -> err=3 while a direct usb_temp_setup(udev, &usb_template_phone) succeeds at FULL/HIGH speed and serves internally consistent descriptors (run.2.log phone sweeps, anom=0). Simultaneously, the pack is the pass-2 negative-evidence record for the whole file: 187,272,018 crafted host requests through the real descriptor demux (all descriptor types x indices x langids x request types x 9 templates x 3 speeds) yielded ZERO anomalies and no panic; the two-pass builder matched an independent size recomputation for every template/speed. No memory-safety, leak, or privilege impact; fix is a one-line case addition (fix.diff) or deleting the template as upstream FreeBSD did.",
  "exploit_chain": "",
  "evidence": "run.initial-expectation-fixes.log line 2 (setup_by_index(7) err=3); run.2.log phone sweep lines + final FUZZ: PASS calls=187272018 nonnull=380 stalls=187271638 anomalies=0; VERDICT.md table maps each claim to its decisive lines; fix.diff applies cleanly to sys/ (git apply --check).",
  "kernel_refs": [
    "sys/bus/u4b/template/usb_template.c:1341-1376",
    "sys/bus/u4b/usb_ioctl.h:56-67",
    "sys/bus/u4b/template/usb_template_phone.c:353",
    "sys/bus/u4b/template/Makefile:45",
    "sys/bus/u4b/usb_device.c:1727"
  ],
  "poc_changes": "No seed PoC existed - harness written from scratch for this pass-2 run. Iterations: (1) added generated opt_usb.h/opt_bus.h/bus_if.h/device_if.h for the out-of-tree KLD build; (2) mirrored usb_template.cs exact include order; (3) fixed variadic kprintf format under -Werror; (4) after run 1, corrected harness expectations: the template enum has NINE values (SERIALNET=8 is valid; my loop had assumed 0..7) and SUPER-speed setup legitimately fails USB_ERR_INVAL because template mps[] tables define FULL/HIGH only (usb_template.c:221-225); (5) added usb_template_phone to the direct-setup table for run 3 to prove the template itself is functional.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp/utfz && make -m /usr/share/mk -m /usr/src/sys/conf",
  "run_cmd": "kldload usb_template; kldload /tmp/utfz/usb_template_fuzz.ko; dmesg | grep FUZZ",
  "code_hash": "6ab3dbc98e3d9a73404a85d8a58009a10af421bdff3f0db3c83456c9dcb1c42b",
  "notes": "Negative-evidence scope: full dispatch sweep (bmRequestType {0x80,0xA0,0xC0,0x00,0x81,0x21,0x8A,0xFF} x bRequest {0x06,0x00,0x01,0x07,0xFF} x wValue[1] 0..254 x wValue[0] 0..254 x langid {0,0x0409,0xFFFF,0x0904}) = 10,440,001 requests per template/speed; 27 template/speed combos (9 templates x FULL/HIGH/SUPER, SUPER expected-fail) plus registry sweep 0..1023 + spikes. Two clean PASS runs after expectation fixes (run.log, run.2.log). Guest returned to kldstat baseline (modules unloaded, /tmp/utfz removed); no panic at any point. Cosmetic note: every failed template setup prints usbd_free_config_desc: nullpointer (usb_template.c:1322,1334-1339 -> usb_request.c:1318-1326); observed 33x; log noise only.",
  "recommended_fix": "Add the missing dispatch case: case USB_TEMP_PHONE: err = usb_temp_setup(udev, &usb_template_phone); break; (or delete the dead phone template as upstream FreeBSD did).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Info-only functional fix; kernel rebuild not warranted. The fix was validated indirectly and empirically: the harness drives usb_temp_setup(udev, &usb_template_phone) directly - exactly what the added case invokes - and the phone template builds cleanly and serves valid descriptors at FULL/HIGH (run.2.log, anom=0), so the one-line case addition is proven behaviorally. fix.diff is git-apply-clean against sys/.",
  "fix_evidence": "run.2.log: FUZZ: template phone speed 2 swept (calls=176868017 nonnull=355 ... anom=0) and FUZZ: template phone speed 3 swept (... nonnull=380 ... anom=0); git apply --check findings/poc/DF-5353/fix.diff -> clean."
}