# DF-5591 — vga_probe_unit() "succeeds" without filling the caller's buffer:
# one file-split away from a kernel-stack read programmed into the resource list

## What this is

Evidence pack for the pass-2 finding on `sys/bus/isa/vga_isa.c` (hardening /
Info):

`isavga_probe()` declares `video_adapter_t adp;` **uninitialized** on its
stack (`sys/bus/isa/vga_isa.c:108`) and passes `&adp` to
`vga_probe_unit()`.  `vga_probe_unit()` returns **0** ("success") without
touching `buf` when `vid_get_switch(VGA_DRIVER_NAME)` is NULL
(`sys/dev/video/fb/vga.c:76-78`).  Back in `isavga_probe`, `error == 0`
then programs `adp.va_io_base`, `adp.va_io_size`, `adp.va_mem_base`,
`adp.va_mem_size` — four `int`s of **uninitialized kernel stack** — into
the device resource list via `bus_set_resource()` (`vga_isa.c:118-121`).

Those values are user-visible: `devinfo -rv` dumps per-device resource
ranges to **any** unprivileged user (verified live on the audit rig).

## Why this is filed Info and not higher

The path is **structurally unreachable in every shipped configuration**:
`vga_isa.c` and `vga.c` are both gated on the same `optional vga` kernel
option (`sys/platform/pc64/conf/files:72` and `:199`), so whenever the
isavga driver is present, the `VIDEO_DRIVER(vga, ...)` linker-set entry
(`vga.c:244`) is in the same kernel image and `vid_get_switch("vga")`
cannot return NULL.  Live proof: the guest's vga0 windows are exactly the
statically initialized values (`IO_VGA`=0x3c0/32 and
`EGA_BUF_BASE`=0xa0000/`EGA_BUF_SIZE`=0x20000, `vga.c:175-179`), i.e. the
initialized path ran, not garbage.

The trap is one Makefile/file-split away from activation (e.g. moving
vga.c into its own KLD, or any future glue file reusing vga_probe_unit),
at which point it becomes a kernel-stack info leak into world-readable
devinfo output plus garbage rman claims.  Hence hardening, confidence
certain about the code shape, no demonstrated impact today.

## Reproduce

Nothing to compile:

    ./run.sh    # from the repo root (uses dfbsd-qemu/vm.sh)

Collects the live negative evidence: vga0's exact window values, the
unprivileged readability of devinfo, and (host-side) the config-file gate
that makes the NULL path unreachable.

## Expected output

    vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1

0x3c0/32 and 0xa0000/0x20000 are precisely `IO_VGA`, `32`, `EGA_BUF_BASE`,
`EGA_BUF_SIZE` from the static initializer at `sys/dev/video/fb/vga.c:175-179`
— proving the buffer was written by `vga_probe()`'s `bcopy(adp, buf, ...)`
(vga.c:82), not left uninitialized.