{
  "finding_id": "DF-5666",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "bios.c on pc64 provides exactly one live symbol, bios_sigsearch (bios.c:66-94), a boot-time read-only scan of the firmware-controlled 128KB BIOS window (phys 0xe0000-0xfffff via KERNBASE offset). The bounds math is correct on every in-tree path: the strict loop bound (sp+sigofs+siglen) < end (bios.c:84) keeps every compared byte inside the window, start is validated to [0xe0000,0x100000] (bios.c:72-78), and the sole in-tree caller (ipmi_smbios.c:186) passes only compile-time constants (0xf0000, \"_SM_\", 4, 0x10, 0 from machine/pc/bios.h:56-60). Guest-live introspection confirms: symbol live at ffffffff80c19220; ipmi(4) not compiled into X86_64_GENERIC and not loaded (module-only, /boot/kernel/ipmi.ko), so the function does not even execute in the default configuration; the /dev/mem dump of the window shows SeaBIOSs SMBIOS 2.8 _SM_ anchor at physical 0xf59c0, i.e. firmware data is the only input. The reportable gap is API robustness only: siglen/paralen/sigofs are trusted ints, so a future kernel caller passing paralen==0 gets an infinite kernel loop (bios.c:91) and paralen<0 or sigofs<0 walks outside the window (bios.c:84/87). No user-reachable trigger exists; crash PoC skipped per contract for Info hardening findings, with guest introspection (the reserved evidence class) captured in introspection.log.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5666/introspection.log \u2014 decisive lines: ffffffff80c19220 T bios_sigsearch (live symbol, no bios16/32), ipmi NOT compiled into X86_64_GENERIC => bios_sigsearch does not run at boot (reachability), hexdump line 000159c0 5f 53 4d 5f 28 1f 02 08 = _SM_ SMBIOS 2.8 EPS at phys 0xf59c0 (firmware-only input, window mapped). Code: bios.c:72-78 start validation vs. absent siglen/paralen/sigofs validation; bios.c:84/87/91 the trusting arithmetic. VERDICT.md has the full narrative.",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/bios.c:66",
    "sys/platform/pc64/x86_64/bios.c:72",
    "sys/platform/pc64/x86_64/bios.c:84",
    "sys/platform/pc64/x86_64/bios.c:87",
    "sys/platform/pc64/x86_64/bios.c:91",
    "sys/platform/pc64/include/pc/bios.h:34",
    "sys/platform/pc64/include/pc/bios.h:36",
    "sys/platform/pc64/include/pc/bios.h:56",
    "sys/dev/misc/ipmi/ipmi_smbios.c:186"
  ],
  "poc_changes": "No crash PoC authored (Info hardening; Phase V PoC skipped per contract). Verification artifact is introspect.sh \u2014 exact guest-live introspection commands (symbol table, config/module reachability, /dev/mem window dump) \u2014 executed verbatim via vm.sh run_root; log in introspection.log.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "none (guest-live introspection only)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root \"$(cat findings/poc/DF-5666/introspect.sh)\" > findings/poc/DF-5666/introspection.log",
  "code_hash": "ca3c2b34c8612c1e67cfbadd07ab071cf20edcc1ae0d9f80a9bbc908ec5140ed",
  "notes": "Reserved range DF-5666..DF-5678; only DF-5666 used (one Info finding; nothing higher warranted \u2014 the file is 94 lines, correct on all in-tree paths, firmware-data-only). Downstream SMBIOS table-walk risk belongs to sys/dev/misc/ipmi/ipmi_smbios.c and is already filed as DF-2107 (Medium) \u2014 not re-filed. Guest left up and clean (read-only introspection; no reset needed).",
  "recommended_fix": "Add an entry guard to bios_sigsearch: reject sig==NULL, siglen<=0, paralen<=0, sigofs<0 (return 0) before computing sp \u2014 see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the parameter guard at bios_sigsearch entry. Not kernel-rebuild-validated: there is no triggerable misbehavior on a stock guest (no in-tree caller can pass bad parameters; ipmi(4) is module-only), so no baseline-vs-patched A/B exists for an Info hardening change.",
  "fix_evidence": "findings/poc/DF-5666/fix.diff (git-apply-able unified diff against sys/platform/pc64/x86_64/bios.c; never applied to the read-only audit tree)."
}