{
  "verdict": "reproduced",
  "impact": "panic",
  "finding_title": "UVC REQBUFS-while-streaming frees bq->mem without draining queues/resetting descriptors: kernel UAF write + stale-bytesused maxlen underflow OOB write (uvc_buf.c)",
  "reproduce": {
    "build": "sh build.sh (guest /root/build5434; KLD from real uvc sources; NOTE rm -f *.o *.ko after touching uvc_buf.c - it is #included, not in SRCS)",
    "run": "kldload /root/build5434/bufharness.ko; sysctl hw.bufharness=1|2|3 (UAF proof, guest up); sysctl hw.bufharness=4 (underflow OOB -> panic at predicted VA); fix: patch -p0 < fix.diff in /usr/src, rebuild, repeat - all clean",
    "expected": "vulnerable: 'UAF-WRITE PROVEN: found 2048 bytes of 0x?? pattern inside freed/reclaimed block' x3; mode 4: Fatal trap 12 supervisor WRITE at the printed predicted VA, Stopped at memcpy+0xfa. fixed: 'no hit: found 0 bytes' x3, bytesused=STALE 0x0, count clamps to 8, guest stays up"
  },
  "kernel_refs": [
    "sys/bus/u4b/uvc/uvc_buf.c:517",
    "sys/bus/u4b/uvc/uvc_buf.c:554",
    "sys/bus/u4b/uvc/uvc_buf.c:569",
    "sys/bus/u4b/uvc/uvc_buf.c:91",
    "sys/bus/u4b/uvc/uvc_buf.c:265",
    "sys/bus/u4b/uvc/uvc_buf.c:268",
    "sys/bus/u4b/uvc/uvc_buf.c:346",
    "sys/bus/u4b/uvc/uvc_v4l2.c:613",
    "sys/bus/u4b/uvc/uvc_v4l2.c:620",
    "sys/bus/u4b/uvc/uvc_drv.c:1385"
  ],
  "artifacts": [
    "bufharness.c",
    "trig5434.c",
    "Makefile",
    "build.sh",
    "run.sh",
    "run_panic.sh",
    "build.log",
    "fix_build.log",
    "run.modes123.log",
    "run.vuln2.log",
    "run.vuln3.log",
    "panic.txt",
    "fix_run.log",
    "fix_run_user.log",
    "env.txt",
    "fix.diff",
    "README.md",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}