# DF-5510 -- OOB stack read + cross-field misclassification in ppb_pnp_detect() class search (search_token(class, len))

## What
ppbconf.c:278 passes the interior pointer `class' with the ABSOLUTE device-ID length `len' to search_token(); the scan runs up to (class-str) bytes past the 257-byte stack object str[PPB_PnP_STRING_SIZE+1], and even in-bounds it scans across the following PnP fields instead of stopping at the class field's end.

## Build / run / expected (inside the DragonFly guest)
```
build (guest): sh build.sh     # compiles VERBATIM /usr/src/sys/bus/ppbus/ppbconf.c + ppb_1284.c + ppb_base.c into ppbharness2.ko
run   (guest): sh run.sh       # kldload; sleep 75; dmesg | grep PPBX2
expected pristine: "DF-5510 Ta ... class_id=0 (PRINTER)" (deterministic cross-field misclassification of class value 'QQ')
                  "DF-5510 Tb OOB result: class_id=1 (MODEM)"  (token matched in bytes past the str[] object; dirt map shows MODEM@-164)
                  "DF-5510 Tc control ... class_id=10 (UNKNOWN)" (in-bounds control with identical dirt)
expected patched: Ta=10 UNKNOWN, Tb=10 UNKNOWN, Tc=10 UNKNOWN
```

## Rig
`ppbharness2.ko` compiles the VERBATIM production sources
/usr/src/sys/bus/ppbus/{ppbconf.c,ppb_1284.c,ppb_base.c}; a fake "ppc"
controller on nexus provides a fully scripted (malicious) IEEE1284 peer.
Details in VERDICT.md; shared rig sources in the DF-5510 pack (identical
copies here).