{
  "finding_id": "DF-5489",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static, code-certain finding NOT executed (Info-severity hardening class; same treatment as the DF-5448 uvscom and DF-5438 ulpt siblings): the VISOR branch of uvisor_init() reads an 18-byte struct uvisor_connection_info from the device with USB_SHORT_XFER_OK (uvisor.c:387-389) and never validates actlen -- in contrast to the PALM4 branchs if (actlen < 12) check at uvisor.c:447-451 which correctly covers the offsets that branch consumes (1, 8, 9). The call goes to the raw usbd_do_request_flags(), not usbd_do_request_proc(), so the zeroize-on-error / zero-pad-on-short protection (usb_request.c:782-787) does not apply: an evil Visor-VID:PID device answering with a zero-length or 2-byte data stage (both legal under SHORT_XFER_OK, err==0) leaves connections[]/num_ports as uninitialized kernel stack. The ONLY consumer is the #ifdef USB_DEBUG block (uvisor.c:395-428: UGETW(num_ports) at :400, port_function_id at :407, port printed at :424-425) which discloses up to ~18 stale stack bytes to console/msgbuf on a USB_DEBUG kernel with hw.usb.uvisor.debug >= 1; the loop count is clamped (uvisor.c:401-403), so there is no OOB. Production kernels never read coninfo (dead store; nports is hardwired to 1 at uvisor.c:341), so there is no userspace path and no memory-safety impact -- filed so a future multi-port refactor does not inherit an unvalidated device buffer (this is exactly how DF-5455 umoscom became a real leak: same unguarded pattern, but with a TIOCMGET consumer). Not runtime-testable: no QEMU Visor VID:PID device model exists and the guests X86_64_GENERIC kernel is not built with USB_DEBUG, so the consumer does not exist in the running kernel.",
  "exploit_chain": "",
  "evidence": "Line-accurate static confirmation in VERDICT.md: request uvisor.c:382-389 (wLength 18 == sizeof(coninfo) -- buffer size correct, only completeness unchecked); missing check after the error test at uvisor.c:391-393; intended pattern demonstrated by the PALM4 sibling at uvisor.c:447-451; USB_DEBUG-only consumers at uvisor.c:400, 407, 424-425; no zeroization (raw usbd_do_request_flags bypasses usb_request.c:782-787); guest tree == audited tree (uvisor.c sha256 b742032f...). fix_compile.log: patched production uvisor.ko builds -Werror-clean RC=0.",
  "kernel_refs": [
    "sys/bus/u4b/serial/uvisor.c:380-428",
    "sys/bus/u4b/serial/uvisor.c:387-389",
    "sys/bus/u4b/serial/uvisor.c:400-403",
    "sys/bus/u4b/serial/uvisor.c:407",
    "sys/bus/u4b/serial/uvisor.c:424-425",
    "sys/bus/u4b/serial/uvisor.c:447-451",
    "sys/bus/u4b/usb_request.c:782-787"
  ],
  "poc_changes": "No seed PoC existed; no runtime PoC authored (static Info-class finding, DF-5448/DF-5438 precedent). fix.diff authored and compile-validated.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "patch -p5 < fix.diff onto a scratch uvisor.c; in-tree kmod make (fix_compile.log, RC=0)",
  "run_cmd": "",
  "code_hash": "30c63c714472f6ff5b1efa3c2706933d303d0268e8dc73437010636d7314114d",
  "notes": "Info severity: no production consumer, no OOB (np clamped), debug-only disclosure ceiling (~18 stack bytes as numbers/string-selections on a USB_DEBUG console). Family precedent: DF-5448 (Info), DF-5438 (Info), DF-5455 (Low, only because a TIOCMGET consumer existed). Guest untouched (build-only scratch; uvisor.c md5 unchanged).",
  "recommended_fix": "Require actlen >= UVISOR_CONNECTION_INFO_SIZE (18) before consuming coninfo, mirroring the PALM4 actlen check (full diff in fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Compile-dimension validated (patched production uvisor.ko builds -Werror-clean RC=0 on the guest, fix_compile.log); runtime dimension not testable without a Visor device model and a USB_DEBUG kernel -- the guard is the same shape as the proven PALM4 check at uvisor.c:447-451.",
  "fix_evidence": "fix.diff (sha256 30c63c71...); fix_compile.log (RC=0)."
}