# DF-2032 PoC — Kernel stack info leak via TWS_IOCTL_GET_COMPATIBILITY_INFO

## Preconditions

1. Can open `/dev/tws0` (default: root only, mode 0600 UID_ROOT GID_OPERATOR)
2. 3ware/LSI TWS Thunderbolt SCSI controller present

## Trigger

```sh
cc -O2 -Wall -o tws_leak tws_leak.c
sudo ./tws_leak
```

The PoC issues `TWS_IOCTL_GET_COMPATIBILITY_INFO` with `buffer_length >= 56`
(the full struct size). The driver writes only the first 14 bytes of
`driver_version[32]` from the version string; bytes 14..31 are raw kernel
stack residue.

## Expected output

```
driver_version[0..13]  = "10.80.00.001"
driver_version[14..31] (LEAKED stack bytes):
XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
N/18 bytes non-zero -> kernel stack leaked
```

The leaked 18 bytes vary across invocations (stack residue: return addresses,
frame pointers, etc.).

## Success criterion

Non-zero bytes in `driver_version[14..31]` that vary across runs, confirming
genuine kernel stack leak (not echoed user data — the ioctl scratch buffer is
not pre-zeroed for `_IOWR` commands).

## Fix

Add `bzero(&cpkt, sizeof(cpkt));` after the declaration at line 267, or use
`struct tws_compatibility_packet cpkt = { {0} };`.