# DF-1237 — README

## Finding

`trm_ExecuteSRB` at `sys/dev/disk/trm/trm.c:434-440` copies `nseg`
scatter/gather entries into `pSRB->pSRBSGL` (a DMA-coherent buffer of
`TRM_MAX_SG_LISTENTRY=32` entries — `trm.h:92`, `trm.c:3498`) with no
bounds check. Two paths reach it:

- **`CAM_SCATTER_VALID`** at `trm.c:666-669` passes `pcsio->sglist_cnt`
  (a `u_int16_t`, 0..65535) straight from userspace — up to 65535 × 8B
  = ~512 KB DMA-coherent heap overflow.
- **`bus_dmamap_load` callback** at `trm.c:625`: `buffer_dmat` is
  created with `nsegments=TRM_NSEG=33` (`trm.h:98`, `trm.c:3429`) on
  x86_64 (MAXPHYS=128KB → btoc=32 → TRM_NSEG=33) → legitimate 33rd
  segment overflows by 1 entry (8 bytes).

## Verdict

**NOT REPRODUCED** on this guest: `trm` is **not in X86_64_GENERIC**
(`sys/config/X86_64_GENERIC` has no `device trm`) and no Tekram DC-395
controller is present in `pciconf -lv`. `trm_ExecuteSRB` is dead code on
this kernel. PoC prints the reachability status.

**Confidence (bug is real):** certain — traced line-by-line in `sys/`.
**Impact ceiling:** operator-group → kernel heap corruption via DMA
coherent slab overflow, on any host with a Tekram DC-395U/UW adapter and
the `trm` module loaded.

## How to reproduce

```
./build.sh && ./run.sh
```

Expected on this guest: PoC builds clean, prints "trm driver NOT loaded
(no 'device trm' in X86_64_GENERIC)" and "trm_ExecuteSRB is dead code on
this kernel". On a host with the `trm` module loaded and a Tekram
adapter, `pass(4)` `CAMIOCOMMAND` `XPT_SCSI_IO` with
`CAM_SCATTER_VALID` and `sglist_cnt > 32` overflows `pSRBSGL`.

## Files

| Path                  | Purpose                                                  |
|-----------------------|----------------------------------------------------------|
| `trm_sg_overflow.c`   | PoC: reachability check (kldstat grep trm)               |
| `build.sh` / `run.sh` | exact build/run commands                                 |
| `fix.diff`            | reject nseg > TRM_MAX_SG_LISTENTRY; change buffer_dmat nsegments TRM_NSEP -> TRM_MAX_SG_LISTENTRY |
| `VERDICT.md`          | full path:line trace, threat model, fix rationale        |
| `build.log` / `run.log` | PoC build + run outputs                                |
| `fix_build.log`       | module-build compile validation of fix.diff              |
| `env.txt`             | guest uname / cc / device topology                       |