{
  "finding_id": "DF-5481",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "efi_get_table() returns the table location as a KERNEL direct-map virtual address (efirt.c:481, *ptr = PHYS_TO_DMAP(ct->ct_data)) and the EFIIOC_GET_TABLE ioctl (efidev.c:77-84) copies that pointer verbatim back to userspace \u2014 a kernel-VA disclosure through the root-only /dev/efi (0700 root:wheel, efidev.c:205-206), and an ioctl that can never work as an API since the DMAP is not mapped in any user pmap. The kernel-side mechanic was demonstrated on the guest by the DF-5477 harness (verbatim function copy): ct_data 0x00DEADBEEF000 returned as kernel pointer 0xffffc5eadbeef000 (DMAP base 0xffffb80000000000, empirical). The end-to-end userspace delivery leg is not testable on this BIOS-boot rig (efi_get_table returns ENXIO \u2014 efi_cfgtbl NULL), hence inconclusive. Root-gated, fixed-offset DMAP, no privilege boundary crossed: Info severity, filed for completeness of the /dev/efi surface.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5477/run.log: DF-5477A: FOUND entry 199 past table end -> returned kernel DMAP pointer 0xffffc5eadbeef000; efirt.c:481; efidev.c:77-84, efidev.c:205-206.",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/efirt.c:481",
    "sys/dev/misc/efirt/efidev.c:77",
    "sys/dev/misc/efirt/efidev.c:205"
  ],
  "poc_changes": "No dedicated PoC: mechanic covered by the DF-5477 harness; the ioctl delivery leg needs an EFI boot.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Upstream FreeBSD later reworked this ABI to copy table contents \u2014 supporting evidence that the pointer-return ABI is recognized as broken.",
  "recommended_fix": "Change EFIIOC_GET_TABLE to copy out the table contents (bounded) instead of returning a kernel DMAP pointer.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No fix validation possible on this rig (ioctl path returns ENXIO on BIOS boot).",
  "fix_evidence": ""
}