DF-2262 — kernel panic captured from dfbsd-qemu/boot.log after issuing
CAMIOCOMMAND XPT_DEV_MATCH with a poisoned cdm->pos.cookie.bus via /dev/xpt0
(run as root; maxx cannot open /dev/xpt0).

------------------------------------------------------------------------
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer = 0x8:0xffffffff802acbf1
stack pointer         = 0x10:0xfffff80118293638
frame pointer         = 0x10:0xfffff80118293678
code segment          = base 0x0, limit 0xfffff, type 0x1b
                      = DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags      = interrupt enabled, resume, IOPL = 0
current process       = 996
Stopped at            xptbustraverse+0x61:    movq    0x10(%r15),%r13
db>
------------------------------------------------------------------------

Interpretation:
- The trap is in `xptbustraverse` (sys/bus/cam/cam_xpt.c:2631), the function the
  finding cites. The faulting instruction `movq 0x10(%r15),%r13` dereferences the
  attacker-supplied fake `struct cam_eb *` (0x4141414141414141) that
  xptedtmatch() passed verbatim from cdm->pos.cookie.bus (cam_xpt.c:2446).
- This confirms the controlled-deref primitive (claim #1 of the finding): a caller
  that sets position_type = EDT|BUS, generations[0]=0 (bypassing the gen check at
  cam_xpt.c:2437-2439), and cookie.bus = arbitrary non-NULL pointer causes an
  immediate kernel trap.
- /dev/xpt0 is mode 0600 root:operator, so this is a root->kernel DoS, NOT an
  unprivileged escalation. The unprivileged actor (maxx) gets "Permission denied"
  on /dev/xpt0 and cannot reach xptioctl at all.