# PoC DF-1590: tws_cam.c firmware-controlled req_id OOB

**Class:** Heap OOB call + OOB struct deref
**Cited site:** `sys/dev/raid/tws/tws_cam.c:1163,1170,512-513,85,96`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/raid/tws/tws_cam.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

tws_intr_resp filters only TWS_INVALID_REQID=0xFFFF, then 1170 sc->reqs[req_id].cb(&sc->reqs[req_id]) NO upper-bound check vs tws_queue_depth (<=256). req_id is u16 from firmware DMA reply. tws_err_complete at 512-513 reads req_id from DMA sense header, NO check at all. tws_get_response extracts from firmware response. OOB req passed to handlers calling xpt_done(req->ccb_ptr) and kfree(req->data).

## Realistic impact ceiling (on suitable HW)

arbitrary cb() call with OOB struct ptr as arg; arbitrary kfree of attacker-controlled address

## Fix

In tws_intr_resp, treat req_id >= tws_queue_depth as invalid; in tws_err_complete, add the same check before indexing sc->reqs[].

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1590.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1590.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```