# PoC DF-1546: advansys sense_len DMA overflow (sibling of DF-1510)

**Class:** DMA buffer overflow (firmware writes 255B into 32B slot)
**Cited site:** `sys/dev/disk/advansys/advansys.c:559, 1185-1186, advlib.c:1712-1720`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/disk/advansys/advansys.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

scsiq.q1.sense_len = csio->sense_len at 559 with NO clamp. sense_len is u8 (cam_ccb.h:602) full user control via CAMIOCOMMAND. adv_send_scsi_queue computes sense_addr into DMA region sized max_openings*32B. Firmware DMAs up to sense_len=255 bytes into 32-byte slot. Last slot q_no==max_openings overflows the entire DMA region.

## Realistic impact ceiling (on suitable HW)

kernel DMA buffer overflow; corrupts adjacent driver state

## Fix

Clamp scsiq.q1.sense_len to imin(csio->sense_len, sizeof(csio->sense_data)) in advrunqueue.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1546.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1546.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```