# DF-0989 — cdreaddvdstructure integer underflow in length math

## Summary
`cdreaddvdstructure()` at `sys/bus/cam/scsi/scsi_cd.c:4288` (default
branch of the result switch) computes:
```c
dvdstruct->length = length - ccb->csio.resid - sizeof(header);
```
With `length` int, `resid` u_int32_t, `sizeof(header)` size_t — promoted
to size_t. A malicious device returning short data (`resid == length`)
yields `(size_t)-4`, truncated to `u_int32_t 0xFFFFFFFC`. The subsequent
`bcopy(databuf+4, dvdstruct->data, min(2048, 0xFFFFFFFC))` reads 2048
bytes from `databuf+4`, but `databuf` was only `length` bytes → kernel
heap OOB read leaked to userspace via `DVDIOCREADSTRUCTURE` ioctl.

**Reachability:** Requires `operator` group membership to open `/dev/cd0`
PLUS a malicious device returning short READ_DVD_STRUCTURE data. maxx is
not in operator group; default QEMU CD-ROM returns well-formed data. Not
triggerable by an unprivileged user.

## Files
- `fix.diff` — git-apply-able fix: clamp the length computation to avoid underflow
- `fix_build.log` — kernel build output showing `scsi_cd.c` compiles cleanly
- `env.txt` — guest environment
- `VERDICT.md` — detailed analysis with type-analysis proof
- `manifest.json` — artifact catalog