# PoC DF-1454: pvscsi autosense memcpy overflows 32-byte sense_data

**Class:** stack/heap OOB write
**Cited site:** `sys/dev/virtual/vmware/pvscsi/pvscsi.c:945-948`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — pvscsi(4) is in GENERIC but only attaches inside a VMware VM with a PVSCSI controller (PCI ID 15ad:07c0). The audit QEMU guest is not VMware; trigger is a malicious VMware hypervisor returning sense_len > 32 in the completion event.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/virtual/vmware/pvscsi/pvscsi.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 945-948 `memcpy(&ccb->csio.sense_data, hcb->sense_buffer, MIN(csio->sense_len, e->sense_len))`. sense_data is `struct scsi_sense_data` = SSD_FULL_SIZE = 32 bytes (scsi_all.h:953). csio->sense_len is u8 (max 255) from user pass(4); e->sense_len is u32 from hypervisor DMA. The MIN can be up to 255, overflowing the 32-byte buffer. The memset at 943 correctly uses sizeof(sense_data) — the memcpy at 945 does not.

## Realistic impact ceiling

corruption (DoS, latent privesc)

## Fix

Wrap the MIN in another MIN with `sizeof(ccb->csio.sense_data)` so the copy is bounded by the destination size.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1454.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1454.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/virtual/vmware/pvscsi && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```