{
  "finding_id": "DF-2264",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Fully reproduced and fix-validated A/B on the stock INVARIANTS kernel using the real saioctl on fabricated CAM state with a real lockmgr SIM lock. Unknown ioctl on the control device returns EINVAL with the SIM lock still held LK_EXCLUSIVE, and a probe thread parked forever on cam_sim_lock proving the SIM-wide wedge; the interrupted-hold path returns EINTR with the lock equally leaked. With fix2264.diff all early returns route through out_locked and the same calls return with the lock released and the probe acquiring it. Privileged reach only (SYSCAP_RESTRICTEDROOT at scsi_sa.c:451): durable CAM-subsystem wedge, no memory corruption, no info leak, no privesc; Low severity confirmed.",
  "exploit_chain": "",
  "evidence": "run_unfixed.dmesg: saioctl returned 22 (EINVAL) SIM lock status AFTER return 2 plus probe thread still BLOCKED after 1s wedge confirmed, and the 2264B block: returned 4 (EINTR) status 2 LOCK LEAKED via scsi_sa.c:912-914; run_fixed.dmesg: status 0 and probe ACQUIRED",
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_sa.c:849",
    "sys/bus/cam/scsi/scsi_sa.c:878",
    "sys/bus/cam/scsi/scsi_sa.c:912",
    "sys/bus/cam/scsi/scsi_sa.c:914",
    "sys/bus/cam/scsi/scsi_sa.c:920",
    "sys/bus/cam/scsi/scsi_sa.c:1345",
    "sys/bus/cam/cam_periph.c:382"
  ],
  "poc_changes": "Replaced seeded sketch with kernel-compiled harness invoking the real saioctl with a real lockmgr lock via fabricated cam_periph and cam_sim and a cdev with si_uminor 1 shl 29 registered through the real cam_extend_set; the interrupted-hold case is driven by a userland sysctl process signalled with SIGUSR1 while cam_periph_hold sleeps in caplck with PCATCH",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #10: Sat Oct 17 20:52:24 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (stock INVARIANTS kernel family; harness builds #2-#10)",
  "runtime_sec": 600,
  "guest_dirty": 1,
  "build_cmd": "./build.sh (shared harness kernel; see ../DF-2263)",
  "run_cmd": "vm.sh run_root sysctl debug.df226x.t2264a=1 ; vm.sh run_root sh -c (sleep 1; kill -USR1 $$) and exec sysctl debug.df226x.t2264b=1",
  "code_hash": "c5eb0e5a2741c97028f40821deddc7ce6676d21a4f77706c83dd1c749148fb69",
  "notes": "On the patched side the recorded 2264B run raced the signal so cam_periph_hold succeeded and the normal exit released the lock; the interrupted-hold leak itself is proven on the unpatched kernel and the fix uses the identical out_locked mechanism validated by the 2264A A/B. privesc per team directive: none, privileged-reach durable DoS only",
  "recommended_fix": "Route the three early returns of the SA_IS_CTRL switch through a common out_locked label that calls cam_periph_unlock before returning",
  "fix_status": "fixed",
  "fix_evidence": "run_fixed.dmesg: EINVAL with lock status 0 and probe acquired on patched kernel versus status 2 and permanent wedge on unpatched (run_unfixed.dmesg)"
}