Priority Summary — 20260820_150314

All Findings — Ranked by Priority

#	Tier	Score	Cat	Function	File	Variable	Sink	Guard	LLM
1	Critical	330	B	`ldm_frag_add`	block/partitions/ldm.c	`f`	sizeof (f) + sizenum	yes?	BUG:undersized_alloc
2	Medium	70	E	`aix_partition`	block/partitions/aix.c	`pvd`	pvd->pp_count	no	FP
3	Medium	70	E	`aix_partition`	block/partitions/aix.c	`pvd`	pvd->psn_part1	no	FP
4	Medium	70	E	`aix_partition`	block/partitions/aix.c	`pvd`	pvd->ppe	no	FP
5	Medium	70	E	`aix_partition`	block/partitions/aix.c	`pvd`	pvd->ppe	no	FP
6	Medium	70	E	`aix_partition`	block/partitions/aix.c	`p`	p->lp_ix	no	FP
7	Medium	70	E	`aix_partition`	block/partitions/aix.c	`p`	p->lv_ix	no	FP
8	Medium	60	B	`alloc_read_gpt_entries`	block/partitions/efi.c	`count`	memcpy() in read_lba()	no	FP
9	Medium	60	B	`alloc_read_gpt_entries`	block/partitions/efi.c	`count`	kmalloc()	no	FP
10	Medium	60	G2	`blkdev_pr_read_keys`	block/ioctl.c	`keys_copy_len`	copy_to_user() unvalidated size	no	FP
11	Medium	60	G2	`bsg_transport_sg_io_fn`	block/bsg-lib.c	`len`	copy_to_user() unvalidated size	no	FP
12	Medium	60	B	`opal_discovery0_end`	block/sed-opal.c	`len_out`	copy_to_user()	no	FP
13	Medium	60	G2	`opal_discovery0_end`	block/sed-opal.c	`len_out`	copy_to_user() unvalidated size	no	FP
14	Low	50	F	`aix_partition`	block/partitions/aix.c	`numlvs`	loop bound	no	FP
15	Low	50	E	`aix_partition`	block/partitions/aix.c	`pvd`	pvd->ppe	yes?	FP
16	Low	50	F	`aix_partition`	block/partitions/aix.c	`numpps`	loop bound	no	FP
17	Low	50	F	`amiga_partition`	block/partitions/amiga.c	`blk`	loop bound	no	FP
18	Low	50	F	`efi_partition`	block/partitions/efi.c	`(inline)`	loop bound	no	FP
19	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->group	yes?	FP
20	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->num	yes?	FP
21	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->rec	yes?	FP
22	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->map	yes?	FP
23	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->list	yes?	FP
24	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->num	yes?	FP
25	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->num	yes?	FP
26	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->map	yes?	FP
27	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->map	yes?	FP
28	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->map	yes?	FP
29	Low	50	A	`ldm_frag_add`	block/partitions/ldm.c	`f`	memcpy()	yes?	FP
30	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->data	yes?	FP
31	Low	50	A	`ldm_frag_add`	block/partitions/ldm.c	`f`	memcpy()	yes?	FP
32	Low	50	E	`ldm_frag_add`	block/partitions/ldm.c	`f`	f->data	yes?	FP
33	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->signature	yes?	FP
34	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->map_count	yes?	FP
35	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->signature	yes?	FP
36	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->start_block	yes?	FP
37	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->block_count	yes?	FP
38	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->type	yes?	FP
39	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->processor	yes?	FP
40	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->name	yes?	FP
41	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->type	yes?	FP
42	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->status	yes?	FP
43	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->processor	yes?	FP
44	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->type	yes?	FP
45	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->type	yes?	FP
46	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->type	yes?	FP
47	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->name	yes?	FP
48	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->name	yes?	FP
49	Low	50	F	`mac_partition`	block/partitions/mac.c	`l`	loop bound	no	FP
50	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->name	yes?	FP
51	Low	50	E	`mac_partition`	block/partitions/mac.c	`part`	part->name	yes?	FP
52	Low	50	F	`parse_bsd`	block/partitions/msdos.c	`max_partitions`	loop bound	no	FP
53	Low	50	F	`parse_solaris_x86`	block/partitions/msdos.c	`max_nparts`	loop bound	no	FP
54	Low	50	F	`response_parse`	block/sed-opal.c	`total`	loop bound	no	FP
55	Low	50	F	`sun_partition`	block/partitions/sun.c	`nparts`	loop bound	no	FP
56	Low	50	F	`sysv68_partition`	block/partitions/sysv68.c	`i`	loop bound	no	FP
57	Low	40	C	`aix_partition`	block/partitions/aix.c	`lv_ix`	subscript (callee)	yes?	FP
58	Low	40	C	`aix_partition`	block/partitions/aix.c	`lv_ix`	subscript (callee)	yes?	FP
59	Low	40	C	`aix_partition`	block/partitions/aix.c	`lv_ix`	subscript	yes?	FP
60	Low	40	C	`aix_partition`	block/partitions/aix.c	`lv_ix`	subscript	yes?	FP
61	Low	40	C	`aix_partition`	block/partitions/aix.c	`lv_ix`	subscript	yes?	FP
62	Low	40	C	`aix_partition`	block/partitions/aix.c	`lv_ix`	subscript	yes?	FP
63	Low	40	C	`aix_partition`	block/partitions/aix.c	`lv_ix`	subscript	yes?	FP
64	Low	40	H	`find_valid_gpt`	block/partitions/efi.c	`good_agpt`	truncation	no	FP
65	Low	40	B	`mac_partition`	block/partitions/mac.c	`part`	strncmp()	yes?	FP
66	Low	40	H	`utf16_le_to_7bit`	block/partitions/efi.c	`c`	truncation	no	FP
67	Low	30	F	`mac_partition`	block/partitions/mac.c	`blocks_in_map`	loop bound	yes?	FP
68	Low	30	F	`osf_partition`	block/partitions/osf.c	`npartitions`	loop bound	yes?	FP

Findings by File

File	Findings
block/partitions/mac.c	21
block/partitions/aix.c	16
block/partitions/ldm.c	15
block/partitions/efi.c	5
block/sed-opal.c	3
block/partitions/msdos.c	2
block/ioctl.c	1
block/bsg-lib.c	1
block/partitions/amiga.c	1
block/partitions/sun.c	1
block/partitions/sysv68.c	1
block/partitions/osf.c	1

Priority Summary — 20260820_150314_block

All Findings — Ranked by Priority

Findings by File