{
  "finding_id": "DF-5744",
  "title": "apple_gmux: missing I/O-region length validation (GMUX_MIN_IO_LEN dead) -> OOB port I/O",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "guest: cd /root/gmuxobs_a && make; host: python3 make_ssdt.py ssdt_a.aml ZZZ0=333",
    "run": "boot with QEMU_EXTRA='-acpitable file=ssdt_a.aml'; kldload gmuxobs.ko; kldload apple_gmux; sysctl hw.gmuxobs_scr",
    "expected": "apple_gmux0 port 0x333-0x336 on acpi0; attach returned -19; hw.gmuxobs_scr goes 0 -> 170 (0xaa)"
  },
  "kernel_refs": ["sys/gnu/dev/misc/apple_gmux/apple-gmux.c:77", "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:737", "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:351"],
  "artifacts": ["README.md", "VERDICT.md", "make_ssdt.py", "ssdt_a.aml", "gmuxobs.c", "Makefile", "build.sh", "run.sh", "run.log", "dmesg.txt", "fix.diff", "fix_validation.log", "env.txt", "manifest.json", "verdict.json"]
}