# VERDICT -- DF-2028 (High)

**Verdict:** INCONCLUSIVE (HW-gated)

**Impact:** UAF confirmed at source (kernel heap write up to GDT_SCRATCH_SZ=3072 bytes); HW-gated (needs iir(4) RAID controller) -- not runtime-triggerable on this guest

**Confidence:** certain

## Mechanism (source-traced)

gdt_ioctl (iir_ctrl.c:245) casts the framework-supplied ioctl buffer ap->a_data to gdt_ucmd_t* and TAILQ_INSERT_TAIL's it into the persistent sc_ucmd_queue (iir_ctrl.c:250), handing a transient buffer (kmalloc'd in sys_generic.c:675, freed at :735 after the driver returns) to the controller with no lifetime management. tsleep at :255 uses PCATCH but its return value is discarded via (void), so a signal interrupts the sleep and control falls through to break (:256); mapped_ioctl then frees the buffer while sc_ucmd_queue and gccb->gc_ucmd (set at iir.c:1006) still reference it. The controller interrupt completion handler (iir.c:1600-1627) later writes up to sizeof(gdt_ucmd_t) bytes into that freed memory (bcopy gccb->gc_scratch -> ucmd->data at iir.c:1615/1619/1624/1626).

## Why not runtime-reproduced

The guest (DragonFlyBSD 6.5-DEVELOPMENT #0 master DEV, KVM) has NO matching
hardware: pciconf shows no mfi/tws/iir RAID controller and no amdgpu/DRM GPU;
the driver therefore cannot attach and the vulnerable path is not runtime-
triggerable here. The defect was **confirmed at the source level** by tracing
the cited `path:line` against `sys/`, and the proposed fix was applied and the
affected module (`iir`) built clean with `-Werror` (see fix_build.log).

## Fix

iir_ctrl.c GDT_IOCTL_GENERAL: loop tsleep until ucmd->complete_flag is set instead of discarding the signal return, so the framework buffer is never freed (by mapped_ioctl) before the controller completion handler is done writing into it.

The standalone, git-apply-able diff is `fix.diff`.