# DF-1578 — hptrr INQUIRY/READ_CAPACITY/SERVICE_ACTION_IN heap OOB write

## At a glance

| Field       | Value |
|-------------|-------|
| Finding     | DF-1578 |
| Severity    | High (filed). Realistic: root→kernel hardening gap |
| Class       | CWE-787 Out-of-bounds Write |
| File        | sys/dev/raid/hptrr/hptrr_osm_bsd.c:582-642 |
| Verdict     | NOT REPRODUCED ON GUEST (real bug, root-only path) |
| Impact      | none (on this guest); latent memory-corruption |
| Confidence  | certain (source-traced line-by-line) |

## The bug, in one sentence

`hpt_scsi_io()` writes fixed offsets into `ccb->csio.data_ptr`
(INQUIRY: 0..35, READ_CAPACITY: 0..7, SERVICE_ACTION_IN: 0..11) without
checking `ccb->csio.dxfer_len`; a CCB with `dxfer_len=0` (root-only via
`/dev/passN`) corrupts memory past the data buffer.

## Reproduce on this guest

**Cannot run.**  `hptrr` is in `X86_64_GENERIC` but no HighPoint RR17xx
PCI RAID controller is present, so the driver never attaches and no
virtual disk is registered with CAM.  Additionally the only user-reachable
path to a hostile `dxfer_len` is `/dev/passN` (mode 0600 root).  See
`VERDICT.md` for the full reachability analysis and `fix_build.log` for
the patched-module rebuild.

## Apply the fix

```sh
cd /usr/src
patch -p1 < findings/poc/DF-1578/fix.diff
# In sys/dev/raid/hptrr:
make SYSDIR=/usr/src/sys      # rebuild hptrr.ko
```

## Files in this folder

| File              | Purpose |
|-------------------|---------|
| `VERDICT.md`      | Full analysis: bug, reachability, fix, threat model |
| `fix.diff`        | git-apply-able unified diff (3 hunks; per-case dxfer_len check) |
| `fix_build.log`   | Patched hptrr_osm_bsd.c compile log (-Werror clean) |
| `env.txt`         | Guest environment + PCI/CAM state |
| `manifest.json`   | Machine-readable catalog |