{
  "finding_id": "DF-5428",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "UVCIOC_CTRL_QUERY (uvc_v4l2.c:677-684) applies copyin() to the kernel-side ioctl buffer that mapped_ioctl() already staged for the driver (sys/kern/sys_generic.c:674-697); std_copyin rejects kernel addresses, so the ioctl returns EFAULT unconditionally. Verified from uid=1001 against the production cdev: GET_CUR and SET_CUR with a valid user data pointer both fail errno=14. The XU control-query feature is dead code from userland; no memory-safety impact (the failure is safe), hence impact=none - a functional bug that also masks the unvalidated qry.query request byte further down.",
  "exploit_chain": "",
  "evidence": "run_user.log / run.log: XUTRIG GET_CUR : ret=-1 errno=14 (Bad address)  buf[0..3]=abababab and SET_CUR : ret=-1 errno=14 with *** DF-5428 CONFIRMED *** as uid=1001; static: sys/kern/sys_generic.c:674-697 stages the kernel buffer, uvc_v4l2.c:678 copyins from it.",
  "kernel_refs": [
    "sys/bus/u4b/uvc/uvc_v4l2.c:678",
    "sys/kern/sys_generic.c:674",
    "sys/bus/u4b/uvc/uvc_drv.c:341"
  ],
  "poc_changes": "Self-contained trigger: local mirror of struct uvc_xu_control_query + _IOWR(u,0x21,...) (needs sys/ioccom.h on the guest); no headers beyond base.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o xu_trig xu_trig.c (guest)",
  "run_cmd": "run_user /tmp/xu",
  "code_hash": "bd4492ab9b98ef157d823a13872007a890999fa7e9d54955e131226a9a72e2ab",
  "notes": "Functional denial only - PoC run because it was free alongside the DF-5427 guest session. No fix validation cycle (not memory corruption); the one-line fix is in README.md (memcpy from the staged buffer + validate qry.query).",
  "recommended_fix": "memcpy(&qry, data, sizeof(qry)) instead of copyin() on the already-staged kernel ioctl buffer (uvc_v4l2.c:678), and validate qry.query against the UVC request set.",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Functional bug (no memory-safety impact); fix is a one-line memcpy documented in README.md; no kernel-rebuild validation cycle warranted.",
  "fix_evidence": "n/a (fix not built; see README.md diff)"
}