# PoC DF-1464: dptexecuteccb SG copy loop overflows per-CCB sg_list

**Class:** heap OOB write (latent)
**Cited site:** `sys/dev/raid/dpt/dpt_scsi.c:730-736, 949`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — dpt(4) HW-gated as above. The specific CAM_SCATTER_VALID code path at line 949 is also not exercised by any standard periph (none sets CAM_SCATTER_VALID on csio), so the bug is currently latent even on real HW.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/raid/dpt/dpt_scsi.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 949 `dptexecuteccb(dccb, segs, csio->sglist_cnt, 0);` is called when CAM_SCATTER_VALID is set, with csio->sglist_cnt (u16, max 65535) UNBOUNDED. The SG copy loop at 730-736 writes nseg entries into dccb->sg_list which is sized dpt->sgsize (<=32). nseg > sgsize overflows the per-CCB SG array.

## Realistic impact ceiling

corruption (latent, DoS)

## Fix

Cap sglist_cnt against dpt->sgsize before invoking dptexecuteccb on the CAM_SCATTER_VALID path; fail with CAM_REQ_TOO_BIG if exceeded.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1464.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1464.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/raid/dpt && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```