=== DF-1028 trigger documentation ===

Vulnerable path (CHIOGSTATUS ioctl on /dev/ch0):
  chioctl -> chgetelemstatus (scsi_ch.c:1053)
    desclen = scsi_2btoul(pg_hdr->edl);    // device-controlled
    avail   = scsi_2btoul(st_hdr->count);  // device-controlled
    for (i=0; i<avail; ++i) {
        copy_element_status(softc, pg_hdr->flags, desc, ces);
        // ^^^ reads ~84 fixed bytes from desc regardless of
        //     desclen, walking past data allocation when
        //     desclen<84 or avail>cesr->cesr_element_count
        desc = (char*)desc + desclen;
    }
    copyout(user_data, cesr->cesr_element_status,
            avail * sizeof(*user_data));

Trigger precondition: a SCSI changer device (or emulated
  changer presenting a malicious READ ELEMENT STATUS response)
  + a privileged user (root or CAP_RESTRICTEDROOT) issuing
  CHIOGSTATUS.
Effect: OOB heap read up to (avail-desclen/84)*84 bytes past
  data, copied out to userspace -> kernel heap leak.

Status on this audit guest (only QEMU DVD-ROM, no SCSI
  changer, no /dev/ch0): NOT REACHABLE. Bug confirmed by code
  trace at sys/bus/cam/scsi/scsi_ch.c:1118, 1159, 1176-1183.
  Fix: clamp avail to cesr->cesr_element_count, reject
  desclen < sizeof(struct read_element_status_descriptor),
  and validate the residual descriptor pointer stays inside
  data. See fix.diff and VERDICT.md.
RUN_EXIT=0