{
  "finding_id": "DF-5427",
  "status": "reproduced",
  "reproduced": true,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Unprivileged VIDIOC_ENUM_FRAMEINTERVALS with index>=0x80000000 turns the signed bounds check at uvc_drv.c:756 into a no-op and reads frm->interval[index].val (uvc_drv.c:768) at an attacker-chosen negative word offset (to -8GiB) below the interval slab; the value is continued-fraction transformed and copied out to any local user via the 0666 /dev/videoN cdev. Verified on the guest: uid=1001 received exactly the predicted interval[-1] value (MATCH 22203/7058), groom markers 0x5A5A5A5A/0xA7A7A7A7 and stale freed-slab contents below the allocation across 3 rounds, kernel pointer halves (0xfffff800...) at k=7/43; index=0x80000000 gave Fatal trap 12 (page fault at interval-8GiB) from the unpriv process, guest down. fix.diff (unsigned index) validated on a rebuilt guest kernel-tree harness: all negative indices -> EINVAL, in-bounds index=0 unchanged, panic attempt harmless, guest up.",
  "exploit_chain": "open /dev/videoN (0666, no privilege, no priority needed) -> ioctl(VIDIOC_ENUM_FRAMEINTERVALS, {.index=(uint32_t)-k, .pixel_format=<enumerated fcc>, .width/.height=<enumerated frame>}) -> kernel reads 4 bytes at interval-4k (inside slab: adjacent object fields; beyond slab: prior/adjacent heap chunks; kernel pointer halves observed) -> CF-transformed 4-byte value returned to user. Wild index (0x80000000) -> unmapped load -> fatal trap 12 -> local DoS. Read-only primitive: strong heap-disclosure for chaining, no write, no direct uid0.",
  "evidence": "run_user.log: TRIGGER k=1 ... got num/den=22203/7058 -> MATCH as uid=1001; k=7 -> 4290000000 (~0xfffff800) and k=8 -> ~0x8d641xxx (kernel heap pointers); LEAKSAMPLE k=33+ markers per round (leak_sample.txt); panic.txt: Fatal user address access from kernel mode from trig, fault 0xfffff7fe4f1e9950 = interval-8GiB, Stopped at uvc_drv_enum_v4l2_frameintervals+0x18b: movl (%rax,%r10,4),%eax; fix.log: all negative indices EINVAL + guest survives --panic; dmesg.txt: kernel-side ground truth scan interval[-i].",
  "kernel_refs": [
    "sys/bus/u4b/uvc/uvc_v4l2.c:562",
    "sys/bus/u4b/uvc/uvc_drv.c:750",
    "sys/bus/u4b/uvc/uvc_drv.c:756",
    "sys/bus/u4b/uvc/uvc_drv.c:768",
    "sys/bus/u4b/uvc/uvc_drv.c:1726",
    "sys/bus/u4b/uvc/uvc_v4l2.c:783"
  ],
  "poc_changes": "Seed sketch rewritten: (1) harness registers the PRODUCTION cdev via uvc_v4l2_reg() so the unpriv userland ioctl path (uvc_v4l2_ioctl dispatch) is exercised for real; (2) small negative offsets are (uint32_t)-k, NOT 0x80000000|k (first attempt used the latter for the sanity call and faulted the kernel at k=1s INT_MIN+2 address - kept as accidental kernel-context pre-proof); (3) local v4l2 struct/ioctl definitions + userland mirror of uvc_simple_frac() to predict the copied-out rational; (4) heap groom with same-size marker chunks so below-slab reads are identifiable.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1740,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (guest /root; KLD=uvcharness from real uvc sources + cc trigger.c xu_trig.c)",
  "run_cmd": "kldload /root/build/uvcharness.ko; sh run.sh; run_user /tmp/trig; run_user /tmp/trig --panic",
  "code_hash": "ca81b3802239545d4b4bc251523905e707f9252cecd79f392f9cb0538a88c9b2 (uvcharness.c), 28eabc791e3aa9621eace637256d0229731ced5c4e722c304529b1f43889d298 (trigger.c)",
  "notes": "Read-only primitive: leak+panic both proven from uid=1001. CF transform (uvc_simple_frac) is deterministic and value-preserving to ~1e7/den^2 - k=1 MATCH proves exact predictability. Impact field set to leak (primary); panic/DoS equally proven (panic.txt). Guest reset clean after validation.",
  "recommended_fix": "Keep itv->index in a uint32_t and do the bounds check in unsigned arithmetic (see fix.diff: uvc_drv.c uvc_drv_enum_v4l2_frameintervals).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to guest /usr/src (patch -p0, both hunks clean); harness rebuilt from patched tree; all negative indices return EINVAL with nothing copied out, in-bounds index=0 still returns 1/30, --panic attempt returns EINVAL and the guest stays up (fix.log, vm.sh status up). Baseline bad behavior gone.",
  "fix_evidence": "fix.log (unpriv trigger on patched build: ioctl failed: Invalid argument for every negative k, UNEXPECTED survival for --panic with guest up); fix_boot.log (kernel-side negative call ret=22 ... num=0 den=0); fix_build.log (clean rebuild)."
}