{
  "finding_id": "DF-5491",
  "status": "untested",
  "reproduced": false,
  "impact": "leak",
  "confidence": "likely",
  "verdict": "UNTESTED (hardware-gated; latent behind DF-5490 until it is fixed): in pcfintrs slave-transmitter paths, char data (pcf.c:396) is stack-uninitialized and is only written by the INTR_TRANSMIT callback (iicbus_intr, iiconf.c:50-51) -- which never writes it when no bus owner exists (owner==NULL: no write) and is a no-op for the two in-tree owners that can hold the bus (/dev/iic registers iicbus_generic_intr, iic.c:78; iicsmb_intrs INTR_TRANSMIT case just breaks, iicsmb.c:225-227). pcf then transmits that uninitialized stack byte on the I2C wire: PCF_SET_S0(pcf, data) at pcf.c:437 and pcf.c:456. A hardware observer (external I2C master addressing the pcfs own slave address) receives 1 byte of leaked kernel stack. Cannot be exercised live: QEMU has no PCF8584 model, and today the call never completes because iicbus_intr() dereferences the never-attached iicbus childs NULL softc first (DF-5490 panic). One byte to a hardware observer, no userland readback path found.",
  "exploit_chain": "",
  "evidence": "source analysis only: pcf.c:396 (char data uninitialized), pcf.c:434-437 and 452-456 (PCF_SET_S0(pcf, data) after callbacks that do not write *buf), iiconf.c:50-51 (only writes via sc->owners INTR method), iic.c:78 (generic no-op), iicsmb.c:225-227 (INTR_TRANSMIT no-op)",
  "kernel_refs": [
    "sys/bus/iicbus/pcf/pcf.c:396",
    "sys/bus/iicbus/pcf/pcf.c:435",
    "sys/bus/iicbus/pcf/pcf.c:437",
    "sys/bus/iicbus/pcf/pcf.c:453",
    "sys/bus/iicbus/pcf/pcf.c:456",
    "sys/bus/iicbus/iiconf.c:50",
    "sys/bus/iicbus/iic.c:78",
    "sys/bus/iicbus/iicsmb.c:225"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Info; hardware-gated (needs PCF8584 silicon + an external I2C master addressing the local slave address); masked by DF-5490 until that is fixed. Phase V skipped per contract (Info hardening).",
  "recommended_fix": "initialize char data = 0 in pcfintr (pcf.c:396) or have iicbus_intr() write a defined value (e.g. 0xFF/NACK) into *buf when there is no owner / no handler.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "",
  "fix_evidence": ""
}