# DF-1869 — PoC evidence pack

Remote kernel heap overflow in `scsi_decap()` via attacker-controlled
Data-In buffer offset. Path:
`sys/dev/disk/iscsi/initiator/iscsi_subr.c:566-574`.

## What is in this folder

| File              | Purpose                                                            |
|-------------------|-------------------------------------------------------------------|
| `harness.c`       | Faithful userspace port of `scsi_decap` ISCSI_READ_DATA; runs both unfixed and fixed |
| `build.sh`        | Builds `harness` (unfixed kernel logic) and `harness_fixed` (with `offset+len<=edtlen` guard) |
| `run.sh`          | Runs both binaries; PASS iff unfixed shows OOB and fixed shows 0 OOB |
| `fix.diff`        | `git apply`-able one-hunk fix for `sys/dev/disk/iscsi/initiator/iscsi_subr.c` |
| `VERDICT.md`      | Full narrative: source trace, primitive characterization, PHASE 6 escalation analysis, PHASE 8 fix validation |
| `build.log`       | Full guest build of the harness (cc 8.3, DragonFly)                |
| `run.log`         | UNFIXED run: 416 bytes written OOB, exit 1                        |
| `run.2.log`       | FIXED run: 0 bytes written OOB, exit 0                            |
| `run.3.log`       | UNFIXED rerun for determinism                                     |
| `fix_build.log`   | Full guest build of `iscsi_initiator.ko` with fix applied         |
| `env.txt`         | Guest environment (uname, cc, INVARIANTS, module status, maxx perms) |
| `manifest.json`   | Machine-readable catalog for the static-site generator             |

## Build & run (on the audit guest as the unprivileged user)

```
sh build.sh
sh run.sh
```

Expected:

```
UNFIXED  total_oob_bytes=416  exit=1
FIXED    total_oob_bytes=0    exit=0
RESULT: unfixed_rc=1 fixed_rc=0
PASS — primitive reproduced unfixed; fix closes it.
```

## Reproducing the fix at the module level (root only)

```
ssh dfbsd
cd /usr/src
patch -p1 < /path/to/this/dir/fix.diff
cd sys/dev/disk/iscsi/initiator
make KERNCONF=X86_64_GENERIC         # rc=0, iscsi_initiator.ko built
strings iscsi_subr.o | grep 'bad data-in'
# Expect: >>> %s: bad data-in bo=%u len=%u edtlen=%u   (absent in the unfixed build)
```

## Caveat — local unprivileged reachability

The vulnerable code lives in the `iscsi_initiator` **loadable module**
(NOT in `X86_64_GENERIC`). An unprivileged user cannot `kldload` it
(`Operation not permitted`) and cannot establish an iSCSI session
(`iscontrol` requires the module). The bug is therefore a **remote** bug:
the realistic threat is a malicious iSCSI **target** taking over the
initiator kernel after an admin has connected to it. The userspace
harness proves the write-what-where primitive deterministically without
requiring the module loaded. See `VERDICT.md` §3 for the full escalation
analysis and the documented hard blocker.