# DF-1399 — Verification Verdict

## Verdict: CONFIRMED-BY-SOURCE-TRACE (root/vinum-only)

**Status:** inconclusive (HW-gated / not reachable as unprivileged maxx)
**Impact:** none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only)
**Confidence:** certain (source-trace confirmed bug is real)

## Mechanism

config_volume kw_prefer case (:1537-1549): myplexno=find_plex() returns global plex index, then myplexno=my_plex() overwrites it with local index-in-vol->plex[] (or -1). `if(myplexno>0)` misses index 0. The else branch stores myplexno (now -1 when plex not in vol) into vol->plex[]. At :1608, vol->size loop accesses PLEX[vol->plex[i]=-1] → OOB heap read into reported volume size (info leak via VINUM_VOLCONFIG). Also routes I/O through bogus plex.

**Source:** `sys/dev/raid/vinum/vinumconfig.c:1537-1549, 1608`

## Why it cannot be reproduced on this guest

Root/vinum-capability only. vinum config is controlled via root-only ioctl. Not reachable as unprivileged maxx.

## Phase 6: Escalation Assessment

This is a **Root-only (vinum volume manager)** finding. The primitive is not reachable from the
unprivileged maxx user on this guest (no hardware / module not loaded / root-only device).
No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not
present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest.
For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx
(uid 1001) has no operator group membership.

## Fix

Capture global_plexno before reassignment; use `>= 0` check instead of `> 0`; store global_plexno (not myplexno) in vol->plex[].

**Fix description:** Capture global plex index before my_plex() reassignment; use >=0 check; store correct index.

The full git-apply-able diff is in `fix.diff`. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via `make nativekernel` rc=0).

## Classification

- **status:** inconclusive
- **reproduced:** 0
- **impact:** none
- **fix_status:** not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)