{
  "finding_id": "DF-5445",
  "title": "Unbounded resource-data ingestion in pnp_read_resources()/pnp_create_devices() (no-END wedge + logical-device memory amplification)",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "(cd /usr/src/sys/bus/isa/hack_dfc && make obj && make depend && make); likewise hack_dfd",
    "run": "timeout 50 kldload /usr/obj/usr/src/sys/bus/isa/hack_dfc/rigdfc.ko ; kldload /usr/obj/usr/src/sys/bus/isa/hack_dfd/rigdfd.ko ; vmstat -m",
    "expected": "baseline: rigdfc never returns (RC=124) with unbounded kmalloc growth (5.57MB->12.4MB+); rigdfd leaves +5.9MB permanent M_DEVBUF. fixed kernel: rigdfc completes in ~4 s with 'too much resource data'; rigdfd stops at 256 logical devices (+258K)"
  },
  "kernel_refs": [
    "sys/bus/isa/pnp.c:546-574",
    "sys/bus/isa/pnp.c:493-526",
    "sys/bus/isa/pnp.c:428-460",
    "sys/bus/isa/pnp.c:453-458"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "verdict.json", "manifest.json",
    "rig/ (shared harness; see DF-5443 pack for file list)",
    "run_endless.log", "run_ldspray.log", "serial_endless_full.log",
    "fix_run_endless.log", "fix_run_ldspray.log", "env.txt"
  ]
}