{
  "finding_id": "DF-5446",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT guest-verified (Low severity, boot-time hardware trigger; below the PoC bar for this run). Static analysis is solid: pnp_create_devices() handles PNP_TAG_LOGICAL_DEVICE with an unconditional 4-byte bcopy(resinfo, &logical_id, 4) at sys/bus/isa/pnp.c:444, but the only bounds validation performed is for the tags declared length PNP_SRES_LEN(tag) in pnp.c:419-425 \u2014 a card-controlled 0..7 value. A declared length of 0..3 leaves the bcopy reading 1-3 bytes past the descriptors data; when the tag sits at the tail of the resource buffer and the buffer occupies len == space of the kmallocd region (attacker-arrangeable: pnp_read_bytes guarantees only len+amount <= space), the read crosses the allocation into uninitialized kernel heap. The tainted logical_id is stored via isa_set_logicalid() (pnp.c:452), matched against pnp_quirks (pnp.c:445) and rendered to the console/log through pnp_eisaformat()-based probe output \u2014 a weak kernel-heap info-leak channel (1-3 bytes per malformed tag). The sibling parser pnpparse.c:95 has the identical unchecked bcopy for PNP_TAG_COMPAT_DEVICE. Recommended fix: reject the tag when PNP_SRES_LEN(tag) < 4 (device_printf + stop scanning), as written in README.md.",
  "exploit_chain": "",
  "evidence": "Static: pnp.c:419-425 (declared-length-only validation), pnp.c:444 (unchecked 4-byte read), pnp.c:445-452 (quirk match, logical-id ivar), pnp.c:398-413 (unrelated ANSI path shows how lengths are handled elsewhere); pnp_read_bytes growth semantics pnp.c:506-515 (len can equal space exactly); pnpparse.c:95 (same pattern).",
  "kernel_refs": [
    "sys/bus/isa/pnp.c:444",
    "sys/bus/isa/pnp.c:419-425",
    "sys/bus/isa/pnp.c:450-452",
    "sys/bus/isa/pnpparse.c:95"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (baseline, analysis only)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity: <=3-byte overread, boot/kldload-time card-data trigger, leak ceiling is a few uninitialized heap bytes into console probe strings. Same root-cause shape as the known DF-1071/DF-2314 family but a distinct sink (fixed-size field read vs scanning-state mis-track), filed separately for a complete fix of the descriptor walks.",
  "recommended_fix": "In pnp_create_devices() PNP_TAG_LOGICAL_DEVICE, require PNP_SRES_LEN(tag) >= 4 before the bcopy (else device_printf + scanning=0); mirror for PNP_TAG_COMPAT_DEVICE in pnpparse.c:95.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "",
  "fix_evidence": ""
}