{
  "finding_id": "DF-5444",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED on DragonFly 6.5-DEVELOPMENT (baseline #0). Same rig family as DF-5443 (verbatim pnp.c engine + virtual card). The card declares one logical device whose MEMORY32_RANGE descriptor carries base=0xE0001001, align=1, size=1. The REAL kernel code path runs end-to-end: pnp_create_devices() creates the child with the real pnp_set_config callback (pnp.c:446-457); after identify returns, isa_driver_added()s child loop (isa_common.c:835-862) calls isa_assign_resources() -> isa_find_memory() (isa_common.c:128-148) which starts its candidate loop AT the card-supplied base with MAX(align,1)=1 stepping, so the first candidate is the misaligned base itself and rman grants it; the config callback then hits if (start & 0xff) panic(\"pnp_set_config: bogus memory assignment\") at pnp.c:260-261. Observed: panic: pnp_set_config: bogus memory assignment with trace pnp_set_config <- isa_assign_resources <- isa_driver_added <- devclass_add_driver <- module_register_init (the genuine kldload flow). Root cause is the missing 256-byte granularity clamp for MEMORY32_RANGE/MEMORY32_FIXED in pnpparse.c (295-300, 323-328) \u2014 unlike PNP_TAG_MEMORY_RANGE which forces align>=0x10000 (pnpparse.c:266-269) \u2014 combined with a panic() as the failure mode in pnp.c. FIX VALIDATED on rebuilt kernel #1 (fix.diff: pnpparse clamps MEMORY32_* alignment to 0x100 and rounds bases to 256; pnp.c downgrades the panic to kprintf + truncation): the identical card stream now loads with RUN_B_RC=0, graceful (null) cant assign resources (memory) (rounded base no longer fits the 1-byte window -> config rejected -> device disabled), guest healthy.",
  "exploit_chain": "crafted ISA-PnP card (or VM-emulated PnP device) -> MEMORY32_RANGE base 0xE0001001 align=1 -> pnp_parse_desc stores arbitrary 32-bit start/align (pnpparse.c:295-300) -> ISA_ADD_CONFIG -> isa_driver_added -> isa_assign_resources -> isa_find_memory first candidate = misaligned base, allocated (isa_common.c:130-147) -> id_config_cb = pnp_set_config -> panic(bogus memory assignment) (pnp.c:260-261) -> kernel panic at boot/driver-load = denial of service.",
  "evidence": "panic.txt + serial_runB_full.log (baseline: panic trace through isa_assign_resources/isa_driver_added); fix_run.log (patched kernel: RUN_B_RC=0, (null) cant assign resources (memory), uptime healthy); fix.diff (pnpparse.c granularity clamps + pnp.c panic->kprintf); rig/ (hack_dfb wrapper, script 2)",
  "kernel_refs": [
    "sys/bus/isa/pnp.c:257-266",
    "sys/bus/isa/pnp.c:260-261",
    "sys/bus/isa/pnpparse.c:295-300",
    "sys/bus/isa/pnpparse.c:323-328",
    "sys/bus/isa/pnpparse.c:266-269",
    "sys/bus/isa/isa_common.c:128-148",
    "sys/bus/isa/isa_common.c:835-862"
  ],
  "poc_changes": "Same rig as DF-5443 (see its poc_changes). Script 2 serves a 27-byte resource stream: LOGICAL_DEVICE tag (len 5) + MEMORY32_RANGE (0x85, len 17, base/endbase 0xE0001001, align 1, size 1) + END. No kprintf in the card path beyond PNPRIG markers; the panic comes from the unmodified pnp.c text.",
  "attempts": 2,
  "guest_uname": "baseline: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 / fixed: #1: Mon Oct 5 16:47:13 UTC 2026 (fix-validated kernel)",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "(cd /usr/src/sys/bus/isa/hack_dfb && make obj && make depend && make)",
  "run_cmd": "kldload /usr/obj/usr/src/sys/bus/isa/hack_dfb/rigdfb.ko   # baseline: immediate panic; fixed: RC=0 + cant assign resources (memory)",
  "code_hash": "e4db996c97f7a4791e143a54d555297b7493f7759a96af75f02e72d484daba75",
  "notes": "DoS (boot-time kernel panic) driven purely by card-supplied descriptor bytes; identical attacker model and severity calibration as DF-5393 (Medium, card-data DoS). The pnp.c panic is the sink; the true fix belongs in pnpparse.c (granularity enforcement) with the pnp.c panic downgraded as defense in depth \u2014 both included in fix.diff. The 0xE0001001 window is free on this guest (same region DF-5393 used), so rman grants the first candidate verbatim.",
  "recommended_fix": "Enforce 256-byte memory granularity in pnpparse.c MEMORY32_RANGE/MEMORY32_FIXED (align>=0x100, base rounded up), and replace pnp_set_config()s panic with a kprintf + base truncation \u2014 full unified diff in fix.diff.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "Single-fix kernel (fix.diff, #1 Mon Oct 5 16:47:13): the exact baseline-panic card stream loads with RUN_B_RC=0; the rounded base no longer fits the cards 1-byte window so the config is gracefully rejected ((null) cant assign resources (memory)), the device is disabled, no panic, guest healthy. Baseline bad behavior GONE.",
  "fix_evidence": "fix_run.log (RUN_B_RC=0, resource-rejection message, healthy uptime); fix_build.log (in DF-5443 pack; full kernel build of the fixed tree); fix.diff (git apply --check clean)",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 5 16:47:13 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}