# DF-1236 — reproduction

## What this is
A **userspace harness** (`harness.c`) that replicates the vulnerable
`trm_MsgInPhase0` extended-message accumulation logic
(`sys/dev/disk/trm/trm.c:1958-1960`) and proves the `MsgInBuf[6]` overflow
primitive against a malicious SCSI target byte stream.

The live **kernel** trigger additionally requires a Tekram DC395 `trm` HBA
plus a malicious SCSI target sending crafted EXTENDED messages — hardware
absent from the QEMU/KVM audit guest, so the kernel OOB is not exercisable
here. The harness proves the logic flaw and the write primitive.

## Build & run (as the unprivileged user)
```sh
./build.sh    # cc -O2 -Wall -o harness harness.c
./run.sh      # ./harness
```

## Expected output
```
DF-1236 trm MsgInBuf overflow harness
MsgInBuf is 6 bytes (trm.h:168); pMsgPtr started at MsgInBuf[1]
Bytes written past end of MsgInBuf[6]: 59
...
PRIMITIVE CONFIRMED: attacker-controlled bytes written past MsgInBuf[6]
into MsgOutBuf and beyond (SRB heap fields). Bug is REAL.
```

## Fix
`fix.diff` — bounds `pMsgPtr` against `MsgInBuf` in the accumulation
branch. Builds cleanly into `trm.ko` (`-Werror`). See `VERDICT.md`.