{
  "finding_id": "DF-5767",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "title": "OHCI sc_noport latched from unvalidated device-reported NDP (0-255): kernel-driven OOB MMIO reads/writes past the 0x100-byte OHCI register file",
  "reproduce": {
    "build": "n/a (hardware-precondition finding; see README.md 'Why not live-verified')",
    "run": "n/a — requires controller reporting NDP>15; QEMU caps num-ports at 15 (hw/usb/hcd-ohci.c:1953) and models HcRhDescriptorA read-only (OHCI_RHA_RW_MASK=0)",
    "expected": "ohci_root_intr OREAD4 loop at 0x54..0x50+4*noport (up to 0x474) on every RHSC; roothub SET/CLEAR port feature OWRITE4 at same range during uhub exploration"
  },
  "kernel_refs": [
    "sys/bus/u4b/controller/ohci.c:286",
    "sys/bus/u4b/controller/ohci.c:283",
    "sys/bus/u4b/controller/ohci.c:462-476",
    "sys/bus/u4b/controller/ohci.c:1606-1616",
    "sys/bus/u4b/controller/ohci.c:2221-2226",
    "sys/bus/u4b/controller/ohci.c:2306-2311",
    "sys/bus/u4b/controller/ohci.c:2324-2329",
    "sys/bus/u4b/controller/ohci.c:2276-2296",
    "sys/bus/u4b/controller/ohcireg.h:97",
    "sys/bus/u4b/controller/ohcireg.h:113",
    "sys/bus/u4b/controller/ohci.h:248",
    "sys/bus/u4b/controller/ohci.h:251"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "fix.diff",
    "itd_offset_sim.py",
    "qemu-hcd-ohci-reference.c",
    "verdict.json",
    "manifest.json",
    "env.txt"
  ]
}