# DF-1235 — README

## Finding

`trm_action` (`XPT_SCSI_IO`) at `sys/dev/disk/trm/trm.c:591,598-599,609-610`
copies `cdb_len` bytes from the CAM CDB into `pSRB->CmdBlock[12]` with NO
bounds check. `CmdBlock` is 12 bytes (`trm.h:145`), but `cdb_len` is a
`u_int8_t` (0..255). A 16-byte CDB (`READ_16`/`WRITE_16` on >2 TB disks)
overflows by 4 bytes into `Segment0`; `pass(4)` with `CAM_CDB_POINTER`
and `cdb_len=200` overwrites `pNextSRB`/`pSRBDCB`/`pSRBSGL`/`pccb`
(`trm.h:144-160`) → SRB type confusion / UAF / hijack.

## Verdict

**NOT REPRODUCED** on this guest: `trm` is **not in X86_64_GENERIC**
(`sys/config/X86_64_GENERIC` has no `device trm`) and no Tekram DC-395
controller is present in `pciconf -lv`. `trm_action` is dead code on
this kernel. PoC prints the reachability status.

**Confidence (bug is real):** certain — traced line-by-line in `sys/`.
**Impact ceiling:** operator-group → kernel heap corruption / type
confusion on any host with a Tekram DC-395U/UW adapter and the `trm`
module loaded.

## How to reproduce

```
./build.sh && ./run.sh
```

Expected on this guest: PoC builds clean, prints "trm driver NOT loaded
(no 'device trm' in X86_64_GENERIC)" and "trm_action is dead code on
this kernel". On a host with the `trm` module loaded and a Tekram
adapter, issuing a `CAMIOCOMMAND` `XPT_SCSI_IO` with `cdb_len > 12`
through `/dev/passN` overflows `CmdBlock`.

## Files

| Path                    | Purpose                                                  |
|-------------------------|----------------------------------------------------------|
| `trm_cdb_overflow.c`    | PoC: reachability check (kldstat grep trm)               |
| `build.sh` / `run.sh`   | exact build/run commands                                 |
| `fix.diff`              | reject cdb_len > sizeof(CmdBlock) in trm_action          |
| `VERDICT.md`            | full path:line trace, threat model, fix rationale        |
| `build.log` / `run.log` | PoC build + run outputs                                  |
| `fix_build.log`         | module-build compile validation of fix.diff              |
| `env.txt`               | guest uname / cc / device topology                       |