{
  "finding_id": "DF-5480",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "EFI table ingestion is signature-only. efirt.c:399-410 validates the system table by its 8-byte signature alone \u2014 th_crc32 (sys/efi.h:115) is never computed or compared; efi_systbl_phys (loader-fed MODINFOMD_FW_HANDLE, machdep.c:2674, bootinfo.c:397) is PHYS_TO_DMAPd at efirt.c:404 with no check against the DMAP extent. efirt.c:440-447 takes st_rt with only a NULL check \u2014 rt_hdr signature/CRC never verified, and the service pointers dispatched at efirt.c:499/528/543/572/587/603 are never checked to lie inside the RT regions efi_create_1t1_map() actually mapped, making them firmware/loader-fed ring-0 call targets inside the 1:1 window (same primitive shape as DF-5365/DF-5432). efirt.c:428-434 ingests the memory-map blob without cross-checking memory_size against the blobs real size or descriptor_size residue (ndesc can overrun the blob). All gaps are source-certain (absence of validation); behavior needs an EFI boot with crafted tables \u2014 impossible on this BIOS-boot rig (efi_init returns ENXIO at efirt.c:399-403 before any of it runs), hence inconclusive by rig limit. Boot-time, firmware/loader-fed: unvalidated-table family, Low severity per precedent.",
  "exploit_chain": "",
  "evidence": "VERDICT.md gap-by-gap trace: no crc anywhere in efirt.c (grep), efirt.c:404-405 signature-only check, efirt.c:440-447 st_rt handling, efirt.c:428-434 blob ingestion, dispatch sites efirt.c:499/528/543/572/587/603.",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/efirt.c:399",
    "sys/platform/pc64/x86_64/efirt.c:404",
    "sys/platform/pc64/x86_64/efirt.c:405",
    "sys/platform/pc64/x86_64/efirt.c:428",
    "sys/platform/pc64/x86_64/efirt.c:433",
    "sys/platform/pc64/x86_64/efirt.c:440",
    "sys/platform/pc64/x86_64/efirt.c:499",
    "sys/platform/pc64/x86_64/machdep.c:2674",
    "sys/sys/efi.h:115"
  ],
  "poc_changes": "No PoC: requires EFI boot with crafted firmware/loader tables; BIOS-boot rig cannot populate any of the inputs.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Family-consistent Low severity (cf. DF-5430-5433). The gaps are certain from source; the conditional impact statement is the honest limit.",
  "recommended_fix": "Verify st_hdr/rt_hdr CRC32, range-check efi_systbl_phys against DMAP_MAX, cross-check service pointers against mapped RT regions, validate memory_size/descriptor_size against the blob length.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No fix validation possible on this rig (baseline not reachable).",
  "fix_evidence": ""
}