# DF-5458 VERDICT — REPRODUCED (uninitialized kernel-stack byte gates and drives a device register) — fix validated

## Bottom line

ichsmb_bread() consumes its `*count` parameter as an input bound AND as the
output count (ichsmb.c:424 validate 1..32, :436 write to ICH_D0 "XXX?",
:441 overwrite), but the only caller (smb.c smbioctl SMB_BREAD) passes
`u_char bcount;` that is never initialized (smb.c:217). The result is:
(1) SMB_BREAD is deterministically broken (EINVAL) whenever the stale kernel
stack byte at that slot is 0 or >32 — on this rig it is, for every attempt,
so the entire block-read interface is dead through /dev/smb;
(2) when the garbage passes the gate, a junk "expected count" byte is written
to the ICH SMBus device register ICH_D0.

## Evidence

baseline_run.log (`uninit` section): 13/13 SMB_BREAD attempts → errno=22
(EINVAL) against a BMC that answers the request (the paired BWRITE succeeds;
with the fixed module the identical BREAD returns real IPMI bytes). Stack
dirtying between calls (pipe write/read) did not change the slot — the byte
sits above all callee frames and only smbioctl itself can write it, so on
this guest it stays a stable invalid value.

fixed_run.log: with fix.diff (smb.c `bcount = 32` + ichsmb_bread clamping
the input), every BREAD succeeds: `rc=0 rcount=3 data=06 18 00`,
fresh-process reads included; the DDC transaction now returns a clean
timeout errno (35) instead of the garbage gate.

## Impact

Functional denial of the SMB_BREAD interface driven by uninitialized kernel
memory + transmission of a garbage count byte to the SMBus host controller.
Not memory-unsafe by itself (all copies stay bounded by min()), but it is
the same contract break whose write side (returning block_count unclamped)
is DF-5457, and it makes the whole /dev/smb block-read API unusable on
stock systems (users have no way to initialize the byte).

## Fix

fix.diff in this pack (shared with DF-5457/DF-5459): smb.c initializes
bcount = 32; ichsmb_bread no longer rejects on stale input — it clamps
(`expect`), transmits `expect` to ICH_D0, and copies/returns
min(block_count, 32).

## Kernel references

sys/bus/smbus/ichsmb/ichsmb.c:424,436,440-441; sys/dev/smbus/smb/smb.c:217,318-330

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.