# DF-1704 — Verdict

**Severity:** Low
**Status:** REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest)
**Impact:** panic
**Confidence:** certain

## Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at `sys/dev/disk/iscsi/initiator/isc_sm.c:267-269,283-286`.

## Mechanism
i_prepPDU computes padding based on total len including ahs_len, but i_send resets n to ds_len and writes (4-(ds_len&03))&03 bytes. With ahs_len not a multiple of 4, i_send writes up to 3 bytes OOB past the kmalloc.

## Fix
Reject ahs_len not a multiple of 4 early in i_prepPDU (RFC 3720 compliance).

The full git-apply-able diff is in `fix.diff`.

## Build validation
fix.diff applies cleanly and compiles with `-Werror` as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).

## Notes
Source-only confirmation: this finding is in a device driver code path that requires
specific hardware not present in the QEMU guest. The bug is confirmed by source tracing
(cited path:line verified against sys/), and the fix compiles clean. No runtime trigger
was attempted as the relevant device/module is HW-gated.