{
  "finding_id": "DF-2265",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Fully reproduced and fix-validated A/B with the real sasetparams and sagetparams against a fake transport answering MODE SENSE with a DATA COMPRESSION page lacking the DCC bit. On the unpatched kernel 1000 compression-only sasetparams calls return ENODEV 1000 times and grow M_SCSISA memuse by exactly 16000 bytes = 1000 x sizeof(sa_comp_t) with 3000 allocation calls (ccomp leaked once per call; mode_buffer and the sagetparams buffer are freed). With fix265.diff adding kfree(ccomp, M_SCSISA) on the ENODEV path the same 1000 calls produce zero net growth. Privileged-reach unbounded kernel memory leak, 16 bytes per failed MTCOMP ioctl on such drives; Info severity confirmed.",
  "exploit_chain": "",
  "evidence": "run_unfixed.dmesg: M_SCSISA after memuse=16000 calls=3000 ENODEV=1000 and LEAK grew by 16000 bytes = 1000 x sizeof(sa_comp_t); run_fixed.dmesg: memuse=0 calls=3000 ENODEV=1000 grew by 0 bytes",
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_sa.c:2757",
    "sys/bus/cam/scsi/scsi_sa.c:2765",
    "sys/bus/cam/scsi/scsi_sa.c:2879",
    "sys/bus/cam/scsi/scsi_sa.c:2938",
    "sys/bus/cam/scsi/scsi_sa.c:2941",
    "sys/bus/cam/scsi/scsi_sa.c:1266"
  ],
  "poc_changes": "Replaced seeded sketch with kernel-compiled harness: only cam_periph_runccb is interposed (fake SCSI transport echoing a DCP page without DCC), everything else real; leak measured in-kernel by summing M_SCSISA ks_use per-cpu memuse and calls before and after",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #10: Sat Oct 17 20:52:24 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (stock INVARIANTS kernel family; harness builds #2-#10)",
  "runtime_sec": 300,
  "guest_dirty": 1,
  "build_cmd": "./build.sh (shared harness kernel; see ../DF-2263)",
  "run_cmd": "vm.sh run_root sysctl debug.df226x.t2265=1000 ; vm.sh run_root dmesg | grep DFH2265",
  "code_hash": "c5eb0e5a2741c97028f40821deddc7ce6676d21a4f77706c83dd1c749148fb69",
  "notes": "privesc per team directive: none; slow privileged kernel memory leak, no corruption. Note the impact field reflects the strongest honest classification (dos-class resource exhaustion) although the finding was filed as Info",
  "recommended_fix": "Free ccomp with kfree(ccomp, M_SCSISA) on the params_to_set == SA_PARAM_NONE ENODEV return path in sasetparams",
  "fix_status": "fixed",
  "fix_evidence": "A/B dmesg logs: 16000 bytes leaked over 1000 ENODEV calls unpatched versus 0 bytes patched, identical allocation counts"
}