Summary

dcons_checkc() decodes 24-bit pos from shared FireWire DMA buffer iptr[] field and in generation-skipped recovery branch assigns it directly to ch->pos without checking pos<ch->size (dcons.c:96-97). FireWire peer that can DMA-write published dcons buffer can push ch->pos to any value up to 0xffffff (16 MB); next poll executes ch->buf[ch->pos] (dcons.c:101) reading up to ~16 MB past the 16 KB ring buffer. Read byte delivered to /dev/dcons reader; if offset unmapped kernel panics in softclock context. dcons_timeout (dcons_os.c:337-352) calls dcons_os_checkc unconditionally every ~10ms so read/panic fires with no open tty required. Shared dcons_buf mapped for FireWire bus-master access (dcons_crom.c:183-185) physical address published in Config ROM (dcons_crom.c:120-121). FireWire async transactions unauthenticated any peer on bus can write. Attack sequence: (1) read target Config ROM locate dcons leaf recover dcons_paddr; (2) write 0x05FFFFFF to iptr[0] (gen=5 pos=0xffffff) sanity branch sets ch->gen=5 ch->pos=0xffffff returns -1; (3) sleep 15ms; (4) write 0x06000000 to iptr[0] (gen=6=next_gen pos=0) next tick neither empty test nor sanity branch fires dcons.c:101 executes ch->buf[0xffffff] OOB read; (5a) unmapped -> kernel panic softclock vm_fault; (5b) mapped -> byte through l_rint to tty reader. Required config: dcons_crom loaded + FireWire controller (not default DragonFly). Impact: (a) DoS panic repeated at will no userland process to blame; (b) kernel memory info leak 1 byte/10ms ~16MB window past dcons buffer if /dev/dcons open by root. dcons_ischar (47-73) has identical bug at :67-68 dead code in-tree.