# DF-1238 — trm_Reselect circular DCB ring (infinite loop / DoS)

## Verdict: NOT REPRODUCED (dead code at runtime — no hardware)

## Mechanism (source-level, confirmed real)

`trm_Reselect()` at `sys/dev/disk/trm/trm.c:2411` handles SCSI target
reselection. After reading the reselected target/LUN id at line 2426:

```c
RselTarLunId = trm_reg_read16(TRMREG_SCSI_TARGETID) & 0x1FFF;
pDCB = pACB->pLinkDCB;
while (RselTarLunId != *((u_int16_t *) &pDCB->TargetID)) {
    pDCB = pDCB->pNextDCB;
}
```

The DCB list is **circular**: in `trm_initDCB()` (line 2893-2911) the first
node's `pNextDCB` points to itself, and each subsequent node is inserted so
the tail links back to `pLinkDCB`. So if `RselTarLunId` matches **no** DCB
(e.g. a malicious/misbehaving SCSI target reselects with a fabricated
target/LUN), this `while` loop has no termination and spins forever in the
interrupt handler context, freezing the system (hard hang, requires power
cycle).

The bounded-walk pattern is already used elsewhere in the same file at
lines 2301-2311 (`for (i = 0; i < cnt; i++)` using `pACB->DeviceCnt`),
confirming the author intended bounded iteration.

**The bug is real in source.** A malicious SCSI target that reselects with
an ID/LUN not matching any known DCB causes an unbounded loop in interrupt
context.

## Why it cannot reproduce on this guest

`trm` is the **Tekram DC395U/UW/F** SCSI host-bus-adapter driver.

- **NOT in X86_64_GENERIC**: only in LINT64 (`sys/config/LINT64`).
- Available as a loadable module `trm.ko`, but **not loaded** on the guest
  (`kldstat` shows only `ehci.ko`, `xhci.ko`).
- The QEMU guest has **no SCSI HBA at all** — `pciconf -l` shows only
  440FX/PIIX3/PIIX4 bridges, VGA, virtio-net, virtio-blk.
- Even if `kldload trm` were run (requires root), the driver's `trm_probe`
  would find no Tekram PCI device and never attach → no interrupt → no
  reselection path → unreachable.

This is **valid hard blocker: dead/unreachable at runtime on this guest**
(no hardware). The threat model is a malicious SCSI peripheral on a real
system with a Tekram DC395U controller.

## Fix

`fix.diff` bounds the DCB walk by `pACB->DeviceCnt` iterations and, on
no-match, aborts via `TmpSRB` (consistent with the existing unexpected-
reselection abort at lines 2439-2446). Compiled successfully as `trm.ko`.

## Impact

- **On this guest**: none (dead code, no hardware).
- **On a real system**: unprivileged local DoS / system freeze requiring
  power cycle, triggered by a malicious SCSI target reselecting with a
  bogus ID/LUN. No local privilege needed by the attacker — the attack
  surface is a malicious peripheral.