{
  "finding_id": "DF-5406",
  "file": "sys/bus/u4b/usb_hid.c",
  "title": "HID parser push/Pop level under/overflow -> OOB cur[] indexing in hid_get_item -> kernel heap read/write with device-chosen offset and content",
  "verdict": "reproduced",
  "impact": "panic",
  "verdict_detail": "Deterministic cross-object heap corruption (chosen offset +0x1DC into an adjacent live chunk, chosen 32-bit content 0xc0de0010), controlled write+read-back at +24,436 bytes past the 1088-byte kmalloc object, and Fatal trap 12 inside hid_get_item+0x83 (the OOB hid_clear_local zero-store via c=cur[255]) after ~32 hammer rounds with churn; guest wedged in DDB.",
  "reproduce": {
    "build": "guest root: cd /root/hidrig && make   (KLD; SRCS+= opt_usb.h bus_if.h device_if.h)",
    "run": "kldload /root/hidrig/hidrig.ko; sysctl kern.hidrig_mode=3; sysctl kern.hidrig_fire=1  # guard proof; then mode=1 fire=1 x40 with `find /` churn for the panic",
    "expected": "baseline: 'GUARD 7 ... 0xc0de0010  <-- CROSS-OBJECT CORRUPTION', 'item 2: logmin=0xfeed0001', then 'Fatal trap 12 ... Stopped at hid_get_item+0x83: movq $0,0x58(%r10)'; patched kernel: 0/9 guards corrupted, all 40 rounds complete, guest stays up"
  },
  "kernel_refs": [
    "sys/bus/u4b/usb_hid.c:248",
    "sys/bus/u4b/usb_hid.c:274",
    "sys/bus/u4b/usb_hid.c:277",
    "sys/bus/u4b/usb_hid.c:289",
    "sys/bus/u4b/usb_hid.c:345",
    "sys/bus/u4b/usb_hid.c:376",
    "sys/bus/u4b/usb_hid.c:389",
    "sys/bus/u4b/usb_hid.c:402",
    "sys/bus/u4b/usb_hid.c:430",
    "sys/bus/u4b/usb_hid.c:431",
    "sys/bus/u4b/usb_hid.c:444",
    "sys/bus/u4b/usb_hid.c:445",
    "sys/bus/u4b/usb_hid.c:88"
  ],
  "artifacts": [
    "hidrig.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "run.hammer.log", "panic.txt",
    "fix.diff", "fix_run.log", "env.txt",
    "VERDICT.md", "manifest.json", "verdict.json"
  ]
}