=== DF-1029 trigger documentation ===

Vulnerable path (auto-triggered at SCSI changer probe):
  chregister -> chstart CH_STATE_PROBE (scsi_ch.c:485)
    scsi_mode_sense(..., mode_buffer, mode_buffer_len=32, ...)
    // device replies; mode_buffer[3] = blk_desc_len (device-controlled)
  chdone -> find_mode_page_6(mode_header)        // scsi_ch.c:546
    page_start = &mode_header[1] + mode_header->blk_desc_len
    // if blk_desc_len==0xFF, page_start = mode_buffer+259,
    //   227 bytes past the 32-byte allocation
  chgetparams -> find_mode_page_6(...) twice      // scsi_ch.c:1409,1474
    softc->sc_firsts/counts/movemask/exchangemask
    // populated from OOB-read bytes; partially exposed via CHIOGPARAMS

Trigger precondition: a SCSI changer device whose MODE SENSE
  response lies about blk_desc_len. Auto-triggers at probe;
  no user interaction needed once the device attaches.

Status on this audit guest (only QEMU DVD-ROM, no SCSI
  changer, no /dev/ch0): NOT REACHABLE. Bug confirmed by code
  trace at sys/bus/cam/scsi/scsi_ch.c:494-498, 546-547,
  1409-1419, 1474-1484 and scsi_all.h:1418. Fix: validate
  mode_header->blk_desc_len against the buffer size before
  calling find_mode_page_6, or return early on a too-large
  value. See fix.diff and VERDICT.md.
RUN_EXIT=0