# DF-1018 — dastart TRIM unbounded ranges heap overflow + OOB DMA

## Build
```
./build.sh
```
(or: `cc -o harness harness.c`)

## Run
```
./run.sh
```
(or: `./harness`)

## Expected output
The harness computes: with secsize=1 and b_bcount=0x7FFF8000 (DAIOCTRIM max),
the TRIM inner loop produces 32768 ranges into data[512], overflowing by
258048 bytes. OOB DMA dxfer_len = 262144 bytes (info leak to device).

## Preconditions (for runtime trigger)
- A SCSI Direct Access device with secsize=1 (malicious READ_CAPACITY).
- A TRIM request (root DAIOCTRIM or large FS-trim).
- This QEMU guest has NO `da` device — source-level only.

## Fix
`fix.diff` — bound `ranges` against `softc->trim_max_ranges` inside the
inner while(count>0) loop to prevent overflow past data[].