DF-1076 / run.log
sizeof(ichsmb_softc) = 368 offsetof(block_data) = 73 offsetof(mutex) = 105 (first byte AFTER block_data[31]) offsetof(canary) = 169 [CLAMP_FIX disabled — modeling the unpatched audit-source kernel] slave-supplied count byte (ICH_D0) = 255 (>32 = YES — OOB) payload byte (ICH_BLOCK_DB) = 0xaa post-ISR block_count = 255 post-ISR block_index = 255 (== number of bytes written) -- hex dump -- block_data[0..7] : aa aa aa aa aa aa aa aa block_data[24..31]: aa aa aa aa aa aa aa aa mutex.payload[0..7] : aa aa aa aa aa aa aa aa canary[0..7] : aa aa aa aa aa aa aa aa canary[151..159] : aa aa aa aa aa aa aa aa cc bytes corrupted inside struct lock mutex = 64 / 64 bytes corrupted in trailing canary = 159 / 192 payload-bytes (0xAA) found in block_data[32] : 32 / 32 payload-bytes (0xAA) found in mutex.payload[64]: 64 / 64 payload-bytes (0xAA) found in canary[192] : 159 / 192 VERDICT: OOB WRITE CONFIRMED — 223 payload-bytes landed past block_data[31] (64 in mutex, 159 in canary) — primitive matches the ichsmb.c:583 indexed write driven by the unclamped slave count read at ichsmb.c:575. On a live kernel, corrupting struct lock mutex causes an immediate panic on the next lockmgr op (ichsmb.c:615). ============================================ sizeof(ichsmb_softc) = 368 offsetof(block_data) = 73 offsetof(mutex) = 105 (first byte AFTER block_data[31]) offsetof(canary) = 169 [CLAMP_FIX enabled — modeling the patched kernel] slave-supplied count byte (ICH_D0) = 255 (>32 = YES — OOB) payload byte (ICH_BLOCK_DB) = 0xaa post-ISR block_count = 32 post-ISR block_index = 32 (== number of bytes written) -- hex dump -- block_data[0..7] : aa aa aa aa aa aa aa aa block_data[24..31]: aa aa aa aa aa aa aa aa mutex.payload[0..7] : dd dd dd dd dd dd dd dd canary[0..7] : cc cc cc cc cc cc cc cc canary[151..159] : cc cc cc cc cc cc cc cc cc bytes corrupted inside struct lock mutex = 0 / 64 bytes corrupted in trailing canary = 0 / 192 payload-bytes (0xAA) found in block_data[32] : 32 / 32 payload-bytes (0xAA) found in mutex.payload[64]: 0 / 64 payload-bytes (0xAA) found in canary[192] : 0 / 192 VERDICT: NO OVERFLOW — writes stayed inside block_data[32].