=== Phase 8: build iscsi_initiator.ko WITH fix.diff applied ===

## Running kernel (still unpatched baseline #0):
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

## fix.diff applied to /usr/src/sys/dev/disk/iscsi/initiator/iscsi_subr.c:
	       bo = ntohl(r2t->bo);
	       bleft = ddtl;

	       /*
		| r2t->bo / r2t->ddtl are attacker-controlled (wire R2T).
		| Reject any window that does not lie wholly within the
		| initiator's CCB data buffer of edtl bytes; otherwise the
		| loop below would walk csio->data_ptr past its allocation
		| and leak kernel heap memory to the target.
		*/
	       if (bo > edtl || ddtl > edtl - bo) {
		    xdebug("bad R2T: bo=%u ddtl=%u edtl=%u", bo, ddtl, edtl);
		    break;
	       }


## Re-running module build to capture clean output:
RC=0

## Patched module artifact:
-rw-r--r--  1 root  wheel  88880 Jul 20 09:47 /usr/obj/usr/src/sys/dev/disk/iscsi/initiator/iscsi_initiator.ko
SHA256 (/usr/obj/usr/src/sys/dev/disk/iscsi/initiator/iscsi_initiator.ko) = 3825ec7e806a4ba92f58eb091eb6f5c2fdd489fd592250d7b4757a94ff56b980

## Strings: 'bad R2T' compiled-in check is present in patched module:
>>> %s: bad R2T: bo=%u ddtl=%u edtl=%u

## iscsi_r2t symbol present:
0000000000006a70 T iscsi_r2t

## Baseline (unpatched) module sha256 for contrast:
SHA256 (/boot/kernel/iscsi_initiator.ko) = 99e1710b886b2a221a46d2bd5b07818536867b5e6fb8196bc2c5f95ee7a053a8
## (note: 99e1710... is the unpatched baseline; patched module differs)