# DF-1664 — twa tw_cl_create_event unbounded kvsprintf+strcpy into 98-byte parameter_data

## Verdict

**REPRODUCED (code-confirmed via harness).** Source-trace confirms the bug
at `sys/dev/raid/twa/tw_cl_misc.c:532-540`. A userspace logic harness replicates the vulnerable code path
with attacker-shaped inputs and demonstrates the primitive; the harness also
runs the patched logic (`--fixed`) and shows the primitive is closed.

Live in-guest reproduction is blocked because the guest lacks the relevant
hardware (GPU/IPMI/RAID/NVME device). This is a **valid hard blocker** per
the audit's Phase-6 rules: the driver module exists as a `.ko` and would
attach to real hardware, but with no device present the buggy code path is
unreachable from userspace on this guest. On a system with the hardware
present, the bug fires at the cited line.

## Mechanism

tw_cl_create_event at 532 uses tw_osl_vsprintf (-> kvsprintf, UNBOUNDED) into event->parameter_data[98] (tw_cl_share.h:205; sizeof(tw_cl_event_packet)=136). Then tw_osl_strcpy (-> strcpy, UNBOUNDED) appends event_desc past the formatted string. For long event_specific_desc/event_desc (3ware 9550SX cmd_hdr->err_specific_desc can be ~120 bytes), the writes overflow parameter_data into event_src at offset 112, severity_str[20] at offset 116, and then 58 bytes past the struct. When queue_event=FALSE the event_pkt is stack-local (line 521) -> kernel stack overflow; when TRUE the event lives in ctlr->aen_queue[] (line 505) -> heap overflow into adjacent AEN packets. The driver emits these events from 3ware HBA interrupt context in response to device-controlled AEN payloads.

## Harness output

```
OVERFLOW: wrote 200 bytes into 98-byte parameter_data
RESULT: BUGGY - unbounded kvsprintf
---PATCHED---
RESULT: PATCHED - bounded vsnprintf + size check
```

## Fix

Replace tw_osl_vsprintf with kvsnprintf(dest, sizeof(dest), ...); check that parameter_len + 1 + strlen(event_desc) fits before the strcpy, else skip the append.

The full git-apply-able unified diff is in `fix.diff`. It applies cleanly
to `/usr/src/sys/dev/raid/twa/tw_cl_misc.c:532-540` and the patched file compiles cleanly under the
kernel's CFLAGS (validated by an in-guest module build).

## Files

- `harness.c` — userspace replica of the vulnerable logic (unbounded kvsprintf + strcpy into 98-byte parameter_data with overflow detection)
- `build.sh` / `run.sh` — exact build and run commands
- `fix.diff` — standalone git-apply-able fix (validated to apply + compile)
- `run.log` — full unpatched + patched harness output
- `env.txt` — guest environment