{
  "finding_id": "DF-5664",
  "title": "usb_alloc_mbufs() truncates the 64-bit (block_size + sizeof(usb_mbuf)) * nblocks product into usb_size_t before kmalloc — undersized heap allocation with fully OOB data pointers (latent CWE-190->CWE-787; no unprivileged in-tree reachability today)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "./build.sh   (pushes usbmbuf_of.c + Makefile into the guest via base64|openssl, builds /root/df5664/usbmbuf_of.ko with the guest kmod toolchain)",
    "run": "./run.sh      (kldload ./usbmbuf_of.ko as root in the guest)",
    "expected": "baseline: 'kmalloc size (truncated!) = 0x600 (1536)' vs 'bytes truly required = 0x100000600', 32 '<== OOB' data pointers, then Fatal trap 12 supervisor write page fault at usbmbuf_of_modevent+0x1cb (movb $0x41,(%rax)); patched kernel (fix.diff): 'allocation FAILED (NULL)', guest stays up"
  },
  "kernel_refs": [
    "sys/bus/u4b/usb_mbuf.c:62",
    "sys/bus/u4b/usb_mbuf.c:69",
    "sys/bus/u4b/usb_mbuf.c:71",
    "sys/bus/u4b/usb_mbuf.c:77",
    "sys/bus/u4b/usb_dragonfly.h:92",
    "sys/bus/u4b/usb_dev.c:1984",
    "sys/bus/u4b/usb_generic.c:156",
    "sys/bus/u4b/usb_generic.c:2280",
    "sys/bus/u4b/usb_transfer.c:681",
    "sys/bus/u4b/controller/xhci.c:3767"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "usbmbuf_of.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "panic.txt", "run.fixed.log", "run.fixed.console.txt",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}