# DF-5457 PoC — ichsmb_bread returns the raw slave-controlled block count (up to 255) while writing at most 32 bytes: kernel stack disclosure via /dev/smb SMB_BREAD

## Root cause

On successful block read ichsmb_bread does (ichsmb.c:439-442):

```c
if ((smb_error = ichsmb_wait(sc)) == SMB_ENOERR) {
        bcopy(sc->block_data, buf, min(sc->block_count, *count));  /* <=32 bytes */
        *count = sc->block_count;        /* raw slave byte, up to 0xFF */
}
```

`sc->block_count` comes from the slave-supplied count register ICH_D0
(ichsmb.c:574-576) with no clamp (the write side of that is DF-1076 — known,
excluded here). The returned count violates the SMB_MAXBLOCKSIZE(=32) driver
contract. smbioctl then does (smb.c:327-329):

```c
if (s->rcount > bcount) s->rcount = bcount;   /* up to 255 */
error = copyout(buf, s->rbuf, s->rcount);     /* buf = 1024-byte kernel stack array */
```

`buf` (smb.c:211 `char buf[SMB_MAXBLOCKSIZE]` with SMB_MAXBLOCKSIZE=1024,
smb.h:62) had at most 32 bytes initialized by the bcopy, so a slave that
reports count=255 while the user (root) requests rcount=1024 gets
**up to 223 bytes of uninitialized kernel stack** copied to userspace.
Sibling of DF-1091/DF-2330 (amdsmb, same defect class, Medium) and
DF-4990 (smb.c SMB_TRANS variant).

## Live status on this rig

The kernel-side path is fully live (first ichsmb hardware in this audit):
real SSIF block reads work through ichsmb_bread on the q35 rig
(baseline_run.log / fixed_run.log). The >32 precondition cannot be produced
by the stock QEMU: `smbus_read_block()` clamps a slave count larger than the
32-byte buffer to 0 (hw/i2c/smbus_master.c, QEMU 7.2:
`if (rlen > len) { rlen = 0; }`), verified empirically (i2c-ddc at 0x50
returns a 0xFF count byte at offset 1 — reads come back count=0/timeout, and
the container has no toolchain to build a patched QEMU). A malicious slave
(patched QEMU per DF-1076's malicious_slave_qemu_patch.txt sketch, or an
ATtiny on the bus) supplies the precondition directly.

The in-guest `model` mode reproduces the smb.c epilogue arithmetic exactly:
count_in=32 initialized, copyout length 255 → 223 stale-stack bytes (0xAA
pattern) verified to reach the "userspace" buffer.

## Build & run

```
guest: cc -O0 -o /root/df5457_poc /root/df5457_poc.c && /root/df5457_poc model
```

## Fix

ichsmb.c: `*count = min(sc->block_count, 32);` (and clamp the bcopy the same
way) — included in fix.diff (validated module build, -Werror clean).