# DF-1234 — README

## Finding

`ASR_queue_i` (the `I2OUSRCMD` ioctl handler) at
`sys/dev/raid/asr/asr.c` ships up to ~256 KB of uninitialized kernel
slab to userspace because:

- `ASR_fillMessage(void *Message, u_int16_t size)` at `asr.c:486`
  truncates `size` to 16 bits before `bzero` (`asr.c:491`).
- `ReplySizeInBytes` at `asr.c:3262` is `(userMsgSize << 2)`, up to
  0xFFFF<<2 = ~256 KB.
- The reply buffer is `kmalloc(M_WAITOK)` without `M_ZERO`
  (`asr.c:3273-3276`).
- `ASR_fillMessage(Reply_Ptr, ReplySizeInBytes)` at `asr.c:3282`
  silently truncates -> bzero does nothing for `ReplySizeInBytes` ≥ 64 KB.
- `copyout(Reply_Ptr, Reply, ReplySizeInBytes)` at `asr.c:3305` / `:3575`
  ships the unzeroed slab to userspace.

## Verdict

**NOT REPRODUCED** on this guest (latent): no DPT SmartRAID controller on
the audit guest → no `/dev/asrN` device node → ioctl not reachable. The
driver **is** statically linked into `X86_64_GENERIC` (`kldstat -v` shows
`pci/asr`), so the bug path is in the running kernel and fires on real
DragonFly installs with the matching controller.

**Confidence (bug is real):** certain — traced line-by-line in `sys/`.
**Impact ceiling:** root→kernel info-leak (gated by `SYSCAP_RESTRICTEDROOT`
at `asr.c:3107`); up to ~256 KB of stale kernel heap per call. Useful for
slab-grooming state disclosure / KASLR-defeat, not unprivileged.

## How to reproduce

```
./build.sh && ./run.sh
```

Expected on this guest: PoC builds clean, prints "No /dev/asrN found: No
such file or directory" and reachability analysis. On a host with an
`asr(4)` controller and `SYSCAP_RESTRICTEDROOT`, sending `I2OUSRCMD` with
a crafted reply frame leaks up to 256 KB of kernel slab.

## Files

| Path                  | Purpose                                                  |
|-----------------------|----------------------------------------------------------|
| `asr_fillmsg_leak.c`  | PoC: reachability check for /dev/asrN                    |
| `build.sh` / `run.sh` | exact build/run commands                                 |
| `fix.diff`            | cap ReplySizeInBytes to MAX_INBOUND_SIZE; widen ASR_fillMessage size param |
| `VERDICT.md`          | full path:line trace, threat model, fix rationale        |
| `build.log` / `run.log` | PoC build + run outputs                                |
| `fix_build.log`       | kernel-build compile validation of fix.diff              |
| `env.txt`             | guest uname / cc / device topology                       |