{
  "finding_id": "DF-5447",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Reproduced with PRODUCTION CODE: a KLD harness that #includes the unmodified sys/bus/u4b/serial/uvscom.c (newbus registration macros neutered) calls the real static uvscom_pre_param() (uvscom.c:514-533) for all eleven supported baud rates and every one returns EINVAL(22) -- SUPPORTED speeds accepted: 0/11 -- the switch is an inverted transcription (all cases including B150..B115200 fall into return(EINVAL); the return(0) at uvscom.c:532 is dead). Consequence per the production call path: ucom_param() (usb_serial.c:1678-1684) rejects every termios change before queueing ucom_cfg_param, so every tcsetattr fails EINVAL and the device is never programmed (uvscom_cfg_param at uvscom.c:535-615 is unreachable, including the open-time call at usb_serial.c:842 whose error is discarded) -- the port is permanently locked to default termios; driver functionally dead, fails closed, no memory-safety impact. After applying fix.diff to the guests /usr/src copy and rebuilding the same harness: accepted: 11/11 (fixed) with B230400 still EINVAL (run.fixed.log).",
  "exploit_chain": "Attacker supplies (or a victim owns) any SUNTAC VID:PID adapter handled by uvscom (uvscom.c:231-242) -> /dev/ttyU0 created -> open(2) succeeds at defaults but every stty/tcsetattr returns EINVAL and UVSCOM_SET_SPEED/SET_PARAM (uvscom.c:581,614) never reach the device -> serial port unusable for its purpose (local functional DoS; no privilege or memory-safety impact).",
  "evidence": "run.log: UVS5447[A]: pre_param(B150..B115200) = 22 (EINVAL -- REJECTED) x11 and SUPPORTED speeds accepted: 0/11 (BUG: every tcsetattr fails EINVAL, uvscom_cfg_param() is unreachable, uvscom.c:532 return(0) dead); run.fixed.log: accepted: 11/11 (fixed); build.log/fix_build.log: -Werror-clean in-tree kmod builds; VERDICT.md has the full narrative.",
  "kernel_refs": [
    "sys/bus/u4b/serial/uvscom.c:514-533",
    "sys/bus/u4b/serial/uvscom.c:535-615",
    "sys/bus/u4b/serial/usb_serial.c:842",
    "sys/bus/u4b/serial/usb_serial.c:1678-1693"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch (production-code-include class). Bring-up fixes: (1) <sys/termios.h> is unavailable under kernel -nostdinc -> <sys/tty.h>; (2) harness prelude must not include bus/u4b headers before uvscom.c, else usb_debug.hs include guard defeats uvscom.cs USB_DEBUG_VAR-first include and DPRINTF/DPRINTFN expand to implicit nested externs (-Werror); (3) uvscom_devclass/uvscom_driver must be referenced because DRIVER_MODULE was neutered.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/bus/u4b/serial/hx5447 && make (in-tree kmod build, -Werror clean; see build.sh)",
  "run_cmd": "kldload /root/df5447/uvscompreparam.ko; kldunload uvscompreparam; dmesg | grep UVS5447 (see run.sh)",
  "code_hash": "03c79feb0f9119c5b5fc856e7ce52af8778d9b7c95a3ce9117516670a76123b3",
  "notes": "Guest cleaned after runs (uvscom.c md5 restored to a58a99ef02d63a2d2e7f7b661f5224b3, harness dirs + scratch removed, no leftover KLDs). Severity Low: functional DoS only, fails closed, requires the (rare) adapter or an evil clone. fix.diff (sha256 850a7c2ad624d672da4a6fa833209da56cadfe41e119350624b3a68fc79bccb5) git-apply --check passes against the host repo tree.",
  "recommended_fix": "Restore the intended switch in uvscom_pre_param(): the eleven listed cases return 0, only default returns EINVAL (full diff in fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff applied to the guests /usr/src/sys/bus/u4b/serial/uvscom.c; the same production-code harness rebuilt -Werror-clean and re-run: SUPPORTED speeds accepted: 11/11 (fixed) and pre_param(B230400) still EINVAL. Baseline bad behavior (0/11, all-EINVAL) GONE.",
  "fix_evidence": "fix.diff (sha256 850a7c2a...); fix_build.log (RC=0); run.fixed.log (11/11 (fixed)); VERDICT.md Fix validation section."
}