{
  "finding_id": "DF-5448",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static, code-certain finding NOT executed (Info-severity hardening class; no SUNTAC VID:PID device model exists to exercise a short control-IN data stage -- same treatment as the DF-5438 ulpt sibling). uvscom_cfg_read_status() (uvscom.c:714-734) returns data[0]|(data[1]<<8) from a stack buffer that the core leaves uninitialized when a control-IN SUCCEEDS with a short data stage: usbd_do_request_proc() zeroizes the short-read tail only when actlen != NULL (usb_request.c:786-787) and ucom_cfg_do_request hardcodes actlen=NULL (usb_serial.h:220-221); the data-phase loop copies only acttemp bytes (usb_request.c:662-665, 680-681). A 1-byte reply leaves data[1] uninitialized, a 0-length data stage leaves both bytes uninitialized. Impact TODAY is none: the sole caller uvscom_cfg_open() (uvscom.c:640) discards the return value and sc_lsr/sc_msr/sc_unit_status are fed only from the interrupt pipe (uvscom.c:425-446) -- latent DF-1062/DF-2342-class hazard that turns into a kernel-stack disclosure the moment any code consumes the return value.",
  "exploit_chain": "",
  "evidence": "Source trace in VERDICT.md: uvscom.c:719 (uninit data[2]), uvscom.c:733 (uninit read in return), usb_serial.h:220-221 (actlen=NULL), usb_request.c:783-788 (tail zeroization gated on actlen), usb_request.c:662-665+680-681 (short-copy semantics); uvscom.c:640 (return discarded -- why impact is none).",
  "kernel_refs": [
    "sys/bus/u4b/serial/uvscom.c:714-734",
    "sys/bus/u4b/serial/usb_serial.h:220-221",
    "sys/bus/u4b/usb_request.c:783-788"
  ],
  "poc_changes": "No PoC authored: executing the short-read data stage requires a USB device model for the SUNTAC VID:PID that does not exist on the QEMU guest; the defect is provable (and was proven) by direct source tracing of the exact core semantics.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "fix.diff (uint8_t data[2] = {0, 0};) compiled -Werror-clean as part of the combined patched uvscom.ko build on the guest (fix_compile.log, RC=0). Core-level alternative: make ucom_cfg_do_request pass a real actlen (ucom-wide change, family-tracked).",
  "recommended_fix": "Initialize the read buffer in uvscom_cfg_read_status() (one line, full diff in fix.diff); optionally fix the core macro to pass actlen.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Compile-dimension validated (patched production uvscom.ko builds -Werror-clean RC=0 on the guest, fix_compile.log); runtime dimension not testable without a SUNTAC device model -- the uninitialized-read path requires a crafted short control-IN data stage.",
  "fix_evidence": "fix.diff (sha256 fc1e9be926f7708aec146584515283631b46210c6738ea17ae2147b2dac09d23); fix_compile.log (RC=0, combined patched build)."
}