# DF-1339 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unvalidated NCQ error tag allows OOB read on ap_ccbs via malicious device log page

## Source Location
sys/dev/disk/sili/sili.c:2138-2146

## Verdict
Source-confirmed: Unvalidated NCQ error tag allows OOB read on ap_ccbs via malicious dev. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
sili_port_read_ncq_error at sili.c:2138: err_slot=log->err_regs.type&ATA_LOG_10H_TYPE_TAG_MASK(0x1f)=0..31. ap_ccbs has sc_ncmds=31 entries (indices 0..30). tag=31 -> ap_ccbs[31] one past end -> OOB read ccb->ccb_slot, OOB deref ccb->ccb_prb -> wild pointer. Sibling of DF-1211 (ahci NCQ tag OOB). Malicious SATA device. Fix: check err_slot<sc_ncmds.