# DF-1212 — ahci FBSS saved-commands OOB array access

## Reproduce

Not runnable on the audit guest — no AHCI controller is attached (only PIIX4
IDE + virtio-blk). The verification is a static source trace + a compiling
`fix.diff`; see `VERDICT.md` for the line-by-line trace.

To **validate the fix compiles**, after applying `fix.diff` to `/usr/src`:
```sh
cd /usr/src
make -j6 nativekernel KERNCONF=X86_64_GENERIC    # ~6-8 min from warm obj
```
The kernel must link cleanly (`=== NK_DONE rc=0 ===`).

## Bug location
`sys/dev/disk/ahci/ahci.c:3972` — hardcoded loop `for (i = 0; i < 32; ++i)`
in `ahci_issue_saved_commands()` FBSS branch, while `ap->ap_ccbs` is sized
only `sc->sc_ncmds` (4..32). Out-of-range `ci_saved` bits from hardware
CI/SACT registers cause `ap->ap_ccbs[i].ccb_xa.at` to be read OOB.

## Trigger preconditions (NOT met on this guest)
- An AHCI controller that supports FIS-Based Switching Saved (FBSS) — `AP_F_FBSS_ENABLED`.
- The controller reports `CAP.NCS < 31` (so the array is smaller than 32).
- A malicious or buggy controller that stalls a command to timeout and then
  returns CI/SACT bits beyond the reported slot count.

## Files
- `VERDICT.md` — full narrative with `path:line` citations.
- `fix.diff` — git-apply-able unified diff masking `ci_saved` to valid slots.
- `env.txt` — guest environment (uname, PCI devices, kernel config).
- `build.log` — relevant excerpt of the single-fix kernel build.