# PoC DF-1547: advansys cdb_len LRAM overflow + csio tail read-over

**Class:** DMA overflow + adjacent memory over-read
**Cited site:** `sys/dev/disk/advansys/advansys.c:548,565, advlib.c:1816-1818`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/disk/advansys/advansys.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

scsiq.cdbptr = csio->cdb_io.cdb_bytes (548). scsiq.q2.cdb_len = csio->cdb_len NO clamp at 565. cdb_len is u8. cdb_bytes is u8[IOCDBLEN=16]. Sink: advlib.c:1816-1818 adv_write_lram_16_multi at offset ADV_SCSIQ_CDB_BEG=36 of ADV_QBLK_SIZE=64 slot -> 28-byte CDB region. cdb_len=255 OUTSW 254 bytes -> 226 past slot -> 4 firmware queues corrupted. Also over-reads cdb_bytes for cdb_len>16 -> leaks sense_data/sense_len/sglist_cnt/resid/msg_ptr fields.

## Realistic impact ceiling (on suitable HW)

kernel memory corruption of 4 firmware queues + info leak to firmware (and back to CAM)

## Fix

Clamp scsiq.q2.cdb_len to imin(csio->cdb_len, IOCDBLEN) in advrunqueue.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1547.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1547.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```