# DF-5457 VERDICT — NOT REPRODUCED on the available rig (emulator clamps the hostile count); kernel-side path proven live; sink confirmed by trace + model

## Bottom line

The unclamped count return at ichsmb.c:441 (`*count = sc->block_count`,
slave-controlled 0..255) is real and reachable — the block-read path it sits
on was exercised live end-to-end on the q35/ipmi-bmc-sim rig (first live
ichsmb hardware in this audit; real SSIF block reads returned real IPMI
bytes). The leak manifestation needs a slave that reports count>32; stock
QEMU cannot produce one: `smbus_read_block()` (hw/i2c/smbus_master.c in QEMU
7.2) hard-clamps `rlen > len(32)` to 0, verified empirically with i2c-ddc
(its EDID has 0xFF at offset 1, so an SMB_BREAD cmd=1 *would* deliver
count=0xFF on real hardware — on QEMU it yields count=0/timeout instead).
The container hosting this audit has no C toolchain, so a patched QEMU
(DF-1076's malicious_slave_qemu_patch.txt sketch) could not be built. On a
malicious-peripheral threat model (the same precondition DF-1076 was filed
under, High) the arithmetic is deterministic: smb.c:327-329 clamps the user's
rcount (up to 1024) to bcount (up to 255) and copyouts from the 1024-byte
stack buf of which only <=32 bytes were written (model mode: 223 stale-stack
bytes propagate, 0xAA verified).

Caveat on ordering: with count>32 the ISR first OOB-writes block_data
(DF-1076, known), smashing sc->mutex; whether the system survives long
enough to reach the copyout is timing/config dependent (INVARIANTS-free
kernels more likely to survive) — the leak is the read-side consequence of
the same primitive, priced accordingly (Medium, like amdsmb DF-1091).

## What was verified live

1. ichsmb attach + full block-read transaction on real (emulated) ICH9 SMBus:
   `BREAD cmd=3 → rc=0 rcount=3 data=06 18 00` (fixed_run.log; baseline
   module reaches the same code, only the uninitialized *count gate of
   DF-5458 masks it).
2. QEMU clamp behavior: i2c-ddc block reads return count=0 (QEMU truncation),
   never 0xFF.
3. `model` mode output (baseline_run.log): copyout=255, initialized=32,
   stale=223.

## Fix

ichsmb.c bread success path: `*count = min(sc->block_count, 32);` and bcopy
bounded the same — in fix.diff (module rebuilt in-guest, -Werror clean, and
the clamped return observed live: every returned rcount <= 32 in
fixed_run.log).

## Kernel references

sys/bus/smbus/ichsmb/ichsmb.c:440-441 (sink), :574-576 (source of count,
known DF-1076), :64 (block_data[32]); sys/dev/smbus/smb/smb.c:211,318-330
(1024-byte stack buf + min(rcount,bcount) copyout), smb.h:62 (1024 clamp).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.