# DF-0988 — cdsize accepts blksize=0 from READ_CAPACITY

## Summary
`cdsize()` at `sys/bus/cam/scsi/scsi_cd.c:3058` reads
`softc->params.blksize = scsi_4btoul(rcap_buf->length)` with no lower-bound
check. The narrowing at line 3068 only catches 2049-2352 → 2048; it does
not catch `blksize=0`. On the next read, `cdstart()` at line 1530 asserts
`bio_offset % blksize == 0` and divides by `blksize` at lines 1540/1541
→ kernel divide-by-zero panic.

**Reachability:** Requires a malicious SCSI/iSCSI CD-ROM that returns
READ_CAPACITY with `length=0`. On the default guest, `/dev/cd0` is
`root:operator` mode 0640 (maxx cannot open) and the virtual QEMU CD-ROM
returns well-formed data. Not triggerable by an unprivileged user.

## Files
- `fix.diff` — git-apply-able fix: reject media if blksize==0
- `fix_build.log` — kernel build output showing `scsi_cd.c` compiles
  cleanly under `-Werror` with the fix applied
- `env.txt` — guest environment
- `VERDICT.md` — detailed analysis
- `manifest.json` — artifact catalog