{
  "finding_id": "DF-5463",
  "status": "reproduced",
  "verdict": "Deterministic userland demonstration on the guest: PTIOCSETTIMEOUT with 2147484 makes ptioctls *(int*)addr*1000 signed-multiply overflow, io_timeout wraps negative (observable as PTIOCGETTIMEOUT returning 0 for a set value of 2147484 while 2147483 round-trips exactly), and the negative value is consumed as a u_int32_t CDB timeout in ptstart/scsi_send_receive. Root-gated knob self-corruption; no memory-safety impact. Fix validated on a rebuilt guest kernel: the offending value is rejected with EINVAL and the manifest line disappears.",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "run.log (baseline: set=2147484 -> get=0 + OVERFLOW-MANIFEST), run.patched.log (fixed kernel: set=2147484 -> get=2147483, rejected), VERDICT.md",
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_pt.c:648",
    "sys/bus/cam/scsi/scsi_pt.c:654",
    "sys/bus/cam/scsi/scsi_pt.c:483",
    "sys/bus/cam/scsi/scsi_pt.c:691"
  ],
  "poc_changes": "Authored from scratch (no seed). Requires a pt device: created by the DF-5462 ptsim rig (T_PROCESSOR fake SIM) plus a guest kernel built with device pt (not in X86_64_GENERIC).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Mon Oct  5 22:30:30 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/EVILPT  x86_64",
  "runtime_sec": 300,
  "guest_dirty": 1,
  "build_cmd": "in guest: cd /root/poc/DF-5463 && ./build.sh   (cc -O2 -o to5463 to5463.c)",
  "run_cmd": "in guest as root: cd /root/poc/DF-5463 && ./run.sh",
  "code_hash": "9359c0368a9f53702bf2e18ee27e5d98f16aee571d8d1821faa912de7cb610a4",
  "notes": "Baseline captured on unfixed kernel #0 (built 21:02), fix captured on kernel #1 (22:30:30, fix5463.diff + fix5462.diff applied). Guest reset performed at end of run.",
  "recommended_fix": "Reject *(int*)addr > INT_MAX/1000 in PTIOCSETTIMEOUT (see fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "With fix.diff applied and the kernel rebuilt, PTIOCSETTIMEOUT(2147484) returns EINVAL instead of wrapping (GET yields the previous valid 2147483, OVERFLOW-MANIFEST line gone); in-range values 100000 and 2147483 behave identically to baseline.",
  "fix_evidence": "run.patched.log vs run.log; fix.diff"
}