# DF-5676 — VERDICT

**reproduced (userland same-source) / impact=dos (userland crash) / kernel: no impact on current codegen / confidence=certain (the OOB read is real)**

## Reproduced

Guard-page harness against the same-source libprop rig: input `" <"` with the
NUL sentinel as the last byte of a page followed by PROT_NONE —
`prop_array_internalize` SIGSEGVs inside libc memcmp during the
`_prop_object_internalize_context_alloc` preamble skip (run.log). The rig
object disassembly proves the widened read: `cmpl $0x6c6d783f,0x1(%rbx)` — a
4-byte load at xml+1 where only the sentinel byte is valid.

## Kernel side, honestly scoped

The shipped kernel's `_prop_object_internalize_context_alloc`
(0xffffffff809e1510) calls `bcmp` twice for the MATCHes. sys/libkern/bcmp.c
walks byte-wise until p1 is longword-aligned (the sentinel mismatches '?' on
the first byte during that phase and returns immediately for the classic
short-input case), and its block loads are aligned 8-byte loads that cannot
cross a page boundary, with the result masked to the significant bytes. So the
kernel realizes the read past the *object* end (within the slab page) but
cannot fault and cannot disclose. Filed Low for that reason: a real CWE-125
defect with a proven userland crash and a latent kernel UB that any future
bcmp/memcmp "optimization" (SSE, unrolled) turns into a kernel OOB read.

## Fix validation

fix.diff: `if (_PROP_EOF(xml[1])) goto bad;` + `strncmp` MATCH + explicit
per-byte `_PROP_EOF` validation in the find_tag `<!--` test. On the guest:
baseline rig crashes (139), fixed rig runs all probes clean (exit 0).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.