# DF-5497 — crom_next() dereferences the device-derived nested-directory pointer before any bounds check (OOB kernel read up to +64 MB; kernel panic)

File: `sys/bus/firewire/fwcrom.c` — pass 2 (GLM 5.3 re-audit).

## Build (guest, root; requires `/usr/src`, i.e. `vm.sh reset with-src`)

```
sh build.sh          # KLD df5497.ko (production fwcrom.c #included, symbols
                      # renamed via -D) + userspace guard-page model c5497_user
sh /root/df5498/build.sh   # (sibling model, see DF-5498 pack)
```

## Run

```
./c5497_user                 # userspace model: production parser vs guard-page ROM
kldload ./df5497.ko
sysctl kern.df5497_mode=1    # oracle: OOB reads +1.2..16 KB past a kmalloc(1024) ROM
sysctl kern.df5497_fire=1
sysctl kern.df5497_mode=2    # sweep: descents +4..64 MB -> EXPECT KERNEL PANIC
sysctl kern.df5497_fire=1
```

## Expected (baseline, unpatched `/usr/src`)

* userspace model: subtest A (V=300) SIGSEGV at the predicted `rom+1224..1227`
  load (200 bytes into the guard page past the 1024-byte ROM — the load happens
  BEFORE the `CROM_END` comparison that would have rejected the directory);
  subtest B (V=0xffffff) SIGSEGV at `rom+0x4000014` (the full 24-bit, +64 MB
  reach); control C (V=100, in-ROM directory) walks cleanly.
* KLD mode 1: `crom_next: bound check failed` oracle lines — the production
  parser read `crc_len` out of groomed heap neighbours outside the ROM.
* KLD mode 2: `Fatal trap 12` / `panic` with RIP inside `crom_next`
  (observed: `dfh_crom_next+0x53`), guest goes down — see `panic.txt`.

## Fix validation

`fix.diff` applied inside the guest `/usr/src`, module and model rebuilt:
subtests A/B walk cleanly (no fault), oracle lines 4 -> 0, mode 2 completes
with no panic and the guest stays up (`fix_run.log`).

Hardware-gated entry (no FireWire controller in QEMU): the harness feeds the
production parser a device-controlled 1024-byte Config ROM exactly as
`fw_bus_explore()` fills `fwdev->csrrom[]` and `sbp(4)` walks it.