# DF-1347 — VERDICT

**REPRODUCED at the function level** (impact: `panic`).

## Mechanism

amd_Reselect() at amd.c:1829-1831: cur_target = amd_read8(FIFO) ^ HostID_Bit; cur_target = ffs(cur_target) - 1. If a malicious SCSI target drives a bogus reselect ID such that XOR with HostID_Bit yields 0 (or any non-power-of-2), ffs(0) returns 0, so cur_target = -1. The subsequent tinfo[-1], untagged_srbs[-1][lun], disc_count[-1][lun] accesses are OOB within the softc (wild active_srb pointer then dereferenced by the phase engine).

## Why not live-reproduced on the QEMU guest

The AMD 53C974 SCSI HBA driver (amd.c) attaches only to AMD/Tekram DC-390(T) hardware, absent from QEMU guest. The bug requires a malicious/buggy SCSI target on the bus, reachable by a compromised external device.

## Recommended fix

After computing 'cur_target ^= HostID_Bit', check 'if (cur_target == 0 || (cur_target & (cur_target-1)) != 0)'. If invalid, log the bad ID, reset the SCSI bus (RST_SCSI_BUS_CMD) and return without indexing the target arrays.

## Kernel references (confirmed during verification)

- sys/dev/disk/amd/amd.c:1829 (cur_target = amd_read8(FIFO))
- sys/dev/disk/amd/amd.c:1830 (cur_target ^= HostID_Bit)
- sys/dev/disk/amd/amd.c:1831 (cur_target = ffs(cur_target) - 1 -> -1 when 0)
- sys/dev/disk/amd/amd.c:1833-1835 (tinfo[cur_target], untagged_srbs, disc_count OOB)

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`