# DF-2070 PoC — ata_serverworks_tf_read 48-bit-LBA shifts 8 bits too far

## Status: VERIFIED (source-only) + FIX VALIDATED

`ata-serverworks.c:179/182/185` shift `(temp & 0xff00)` by `<<24/<<32/<<40`
when the correct shifts are `<<16/<<24/<<32`. Proof: the *write* path in
the same file (`:205/207/209`) and `ata-intel.c:449/451/453` put SECTOR's
high byte at LBA bits 24-31; the read path must read it back into the
same slot, which requires shift `24-8=16`, not `24`. Each shift is off
by exactly 8 bits.

Result: silent LBA corruption on 48-bit-LBA reads of any LBA with
non-zero upper bits. HW-gated on the audit guest.

See `VERDICT.md` for the source trace and fix validation.

## Reproduce

```
./build.sh   # rebuilds the patched kernel (rc=0 with -Werror)
./run.sh     # source-only confirmation; no runtime PoC (HW-gated)
```

## Fix

`fix.diff` corrects the three shifts: `24 -> 16`, `32 -> 24`,
`40 -> 32`. Now mirrors the write path bit-for-bit.