# DF-1357 — VERDICT

**REPRODUCED at the function level** (impact: `leak:223`).

## Mechanism

amr_linux_ioctl_int() in amr.c handles AMR_CMD_PASS at :624 by 'copyout(ap->ap_request_sense_area, &user->ap_request_sense_area, ap->ap_request_sense_length)'. ap is a struct amr_passthrough copied in from user (:583) — ap_request_sense_length is user-controlled. ap_request_sense_area is uint8_t[32] (AMR_MAX_REQ_SENSE_LEN). A user-supplied length of 255 makes copyout read 223 bytes past the 32-byte sense_area into adjacent fields of the ccb / DMA-coherent array, leaking kernel heap contents. The amr Linux-compat ioctl is root-only (the amr device node is operator/wheel-gated), so this is a root->userspace kernel-info-leak, but the bug is real.

## Why not live-reproduced on the QEMU guest

AMI MegaRAID hardware absent from QEMU guest. The amr module loads only on matching AMI RAID HW. Reachable from the Linux-compat ioctl path by an already-privileged operator (root).

## Recommended fix

In amr_linux_ioctl_int at the AMR_CMD_PASS path, clamp ap_request_sense_length to AMR_MAX_REQ_SENSE_LEN before the copyout: 'uint8_t sense_len = ap->ap_request_sense_length; if (sense_len > AMR_MAX_REQ_SENSE_LEN) sense_len = AMR_MAX_REQ_SENSE_LEN; copyout(ap->ap_request_sense_area, ..., sense_len);'.

## Kernel references (confirmed during verification)

- sys/dev/raid/amr/amr.c:624 (copyout with ap_request_sense_length, unchecked)
- sys/dev/raid/amr/amrreg.h:92 (AMR_MAX_REQ_SENSE_LEN = 0x20)
- sys/dev/raid/amr/amrreg.h:491-492 (ap_request_sense_area[32])

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`