# DF-1171 — PoC evidence pack

Intel MatrixRAID parser OOB heap write in `ata_raid_intel_read_meta()`
(`sys/dev/disk/nata/ata-raid.c`): `raid->total_disks = map->total_disks` (u8,
≤255) is stored at `ata-raid.c:2230` without bounds check, then the loop at
`:2243-2263` writes `raid->disks[disk].*` for `disk < raid->total_disks`,
overflowing `disks[MAX_DISKS=16]` into the trailing `ar_softc` fields
(`lock`/`disk`/`devstat`/`cdev`/`pid`) and adjacent kernel heap.

## How to reproduce

### 1. Overflow-math harness (primary proof)

A userspace replica built from the **real kernel struct definitions**. It proves
the exact overflow size and victim offsets without needing SATA hardware.

```sh
./build.sh harness      # cc -Wall -O2 -o overflow_harness overflow_harness.c
./run.sh harness        # ./overflow_harness   (prints OOB byte count + victims)
```

Expected (bug present): for `map->total_disks = 255`, prints
`RESULT: OOB heap write CONFIRMED — 11472 bytes past disks[15]`.

### 2. Crafted-disk image (live-trigger attempt)

```sh
./build.sh meta         # python3 build_meta.py crafted_raid.img <total_disks>
```

Produces a 2 MB raw image with a valid Intel MatrixRAID metadata block (correct
magic + verified checksum) whose `map->total_disks` is attacker-set (default
32). On a DragonFlyBSD host with an Intel ATA/AHCI controller and an attached ATA
disk, attaching this image as that disk fires `ata_raid_intel_read_meta` at probe
time and triggers the overflow → kernel panic on default GENERIC (INVARIANTS).

> **Note on this guest:** the live in-kernel trigger could NOT be exercised here.
> The DragonFly loader/SeaBIOS hangs on *any* extra hard disk (a blank 64 MB IDE
> disk reproduced the identical hang) before the kernel boots, so the `nata`
> probe path never runs on the crafted disk. See `VERDICT.md` for details. The
> bug itself is unambiguously real (source trace + harness).

## Files

| file | purpose |
|---|---|
| `overflow_harness.c` | harness: real struct layouts, exact overflow math |
| `build_meta.py` | builds the crafted Intel-RAID disk image |
| `fix.diff` | git-apply-able clamp of `total_disks` to `MAX_DISKS` |
| `VERDICT.md` | full analysis: mechanism, primitive, reachability, fix |
| `harness_output.txt` | captured harness stdout (the OOB proof) |
| `fix_build.log` | full single-fix kernel build log (rc=0) |
| `env.txt` | guest environment |
| `manifest.json` | artifact catalog |

## Threat model / impact

Trigger: a malicious SATA/IDE disk (USB-SATA, hot-plug, crafted VM image)
presented to a DragonFlyBSD host on an Intel ATA/AHCI controller. Fires at attach
with no user privilege. Realistic ceiling: **reliable kernel panic / local DoS**
on default GENERIC. uid0 is not realistic — the overflow is blind (attacker
controls content, not slab layout) and fires synchronously at device-attach with
no userspace heap-grooming window. See `VERDICT.md`.