{
  "finding_id": "DF-5510",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "REPRODUCED 4/4 pristine runs in the ppbharness2 KLD rig (verbatim production ppbconf.c compiled inside the guest; scripted malicious IEEE1284 peer delivers a peripheral-chosen device-ID string). ppb_pnp_detect() passes the interior pointer `class together with the ABSOLUTE ID length `len to search_token() (ppbconf.c:278). With a crafted 256-byte ID placing CLS: at offset 248, the token scan reads str[252..507] -- up to 251 bytes past the end of the 257-byte stack object str[PPB_PnP_STRING_SIZE+1] (ppbconf.c:219). In every run the scan matched the MODEM token in out-of-bounds stack bytes (class_id=1) while the in-data class value was QQ; the in-bounds control (same dirt, short ID, scan stays inside str[]) returned UNKNOWN 4/4, proving the flip is caused by the length confusion. The same wrong-length argument also misclassifies fully in-bounds by matching tokens in FOLLOWING PnP fields: CLS:QQ;CMD:PRINTER; is classified PRINTER (4/4) although the class value is QQ. Production ceiling: silent OOB kernel-stack read at every ppbus attach (boot or kldload of ppc/ppbus) driven by peripheral-supplied bytes; class_id has no in-tree readers, so there is no data-exfiltration path and no write primitive -- a latent memory-safety defect (CWE-125). Distinct from DF-2328 (UNKNOWN_LENGTH scan past a non-NUL-terminated buffer) and DF-1093/DF-2327 (NULL+1). Fix validated: with the scan clamped to the class field, Ta and Tb both return UNKNOWN.",
  "exploit_chain": "",
  "evidence": "run.log (pristine decisive run: DF-5510 Tb OOB result: class_id=1 (MODEM) + dirt map showing MODEM surviving at -164B below the attach frame + the ppb: <PnP> receipt proving the crafted 256-byte ID AAAA..CLS:QQA; was delivered verbatim); fix_run.log (patched: class_id=10 UNKNOWN); harness.c (hx_worker Ta/Tb/Tc sections); fix.diff hunk 1.",
  "kernel_refs": [
    "sys/bus/ppbus/ppbconf.c:278",
    "sys/bus/ppbus/ppbconf.c:263",
    "sys/bus/ppbus/ppbconf.c:219",
    "sys/bus/ppbus/ppbconf.c:236"
  ],
  "poc_changes": "No seed PoC existed (pass-2 finding); rig written from scratch following the DF-5418/5419 ppbharness class: verbatim-source KLD (ppbconf.c+ppb_1284.c+ppb_base.c), scripted IEEE1284 nibble-mode peer, fake ppc controller on nexus, real ppbus driver attach. Bring-up fixes: comment typo; the stack pre-dirtier initially collapsed to a single frame via -O2 tail-call optimization (made noinline with a post-call touch).",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 75,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (guest: cp harness.c Makefile /tmp/ppx2; make SYSDIR=/usr/src/sys)",
  "run_cmd": "kldload /tmp/ppx2/ppbharness2.ko; sleep 75; dmesg | grep PPBX2   (sh run.sh)",
  "code_hash": "eaa32f734c11c69696b7b680eca63a67cc24686475391b9b09cbd0c55c6be222",
  "notes": "Hardware-gated in production (needs a crafted IEEE1284 peripheral on a real parallel port); rig removes the hardware dependency by scripting the peer. OOB read is silent: bytes are only memcmpd against pnp_tokens[], never printed.",
  "recommended_fix": "Clamp the class-token scan to the class field: search_token(class, clen, tok) where clen spans class..first NUL within str[len] (fix.diff hunk 1).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to the guests /usr/src/sys/bus/ppbus/ppbconf.c, harness rebuilt from the same verbatim source (module-level rebuild; running kernel unchanged), full rig re-run on a fresh boot: the previously observed bad behavior is GONE (Ta/Tb return class_id=10 UNKNOWN on every patched run, verified on two patched boots). Behavior of the sibling known findings (DF-1093/2327/2328/2329) was not targeted by this diff.",
  "fix_evidence": "fix_run.log / fixrun2.dmesg (patched) vs run.log / run4.dmesg (pristine) in this pack; fix.diff is the exact applied diff.",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}