# DF-2268 — Heap overflow in cdcheckmedia via uncapped num_entries

## Verdict: NOT REPRODUCED (hardware-gated) — source bug CONFIRMED real; fix.diff compiles.

**Classification:** `not_reproduced` / HW-gated / impact=none (on this guest, for an
unprivileged user). The cited memory-corruption bug is **real in source** and the
defense-in-depth `fix.diff` **compiles cleanly** in a full `nativekernel` build
(`rc=0`, `-Werror`, `-DINVARIANTS`).

### Why not reproduced (the gate)

`cdcheckmedia()` runs in the **cd(4) CAM peripheral**, which only attaches to a
CAM-registered SCSI/ATAPI CD target. The audit QEMU guest has exactly **one** CAM
target — the QEMU DVD-ROM reached through the Intel PIIX3 IDE controller via
`ata-cam`, exposing `/dev/cd0` (mode `0640 root:operator`). The trigger further
requires a **malicious SCSI target** that returns a crafted READ TOC whose
`ending_track`/`starting_track` produce `num_entries > 100`. The trusted QEMU
DVD-ROM with no medium (`NOT READY, Medium not present`) cannot be coerced into
emitting such a TOC. The unprivileged actor `maxx` (uid 1001, in **no** privileged
group — not `operator`, not `wheel`) additionally cannot even `open("/dev/cd0")`.

Gate proof (this guest):
```
$ camcontrol devlist
<QEMU QEMU DVD-ROM 2.5+>  at scbus1 target 0 lun 0  (sg0,pass0,cd0)
$ ls -la /dev/cd0
crw-r-----  root operator  /dev/cd0      # maxx not in operator -> EACCES
$ id maxx
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
```
(No `/dev/ch*`, no `/dev/da*`, no SCSI HBA — see `env.txt`.)

### The source bug (real, cited `path:line`)

`sys/bus/cam/scsi/scsi_cd.c`:
- `struct cd_tocdata` cache holds **100** entries + leadout (`scsi_cd.c:136-139`,
  `softc->toc` at `:172`).
- `cdcheckmedia()` computes `num_entries = (toch->ending_track - toch->starting_track) + 2`
  (`scsi_cd.c:2947`) directly from the **device-supplied** TOC header, then guards
  only `num_entries <= 0` (`:2949`). With `ending_track=255, starting_track=0`,
  `num_entries = 257`.
- `toclen = num_entries * sizeof(struct cd_toc_entry)` (`:2952`) and
  `cdreadtoc(periph, CD_MSF_FORMAT, ..., &softc->toc, toclen + sizeof(*toch), ...)`
  (`:2954-2956`) DMA up to `257*8 + 4 = 2060` bytes into the 804-byte `softc->toc`
  cache → **~1256-byte heap overflow** with attacker-controlled content.
- The same uncapped `num_entries` drives OOB writes in the leadout fixup
  (`softc->toc.entries[cdindex - toch->starting_track]` at `:2983`, `cdindex` up to
  `starting_track + 256`) and the BCD-conversion / search loops at `:2987`, `:2997`
  (iterate `num_entries - 1 = 256` times into `entries[100]`).

Attacker model (per the finding): control of the SCSI/USB CD device (USB mass-storage
gadget, iSCSI LUN, scsi_target LUN). Victim: a `SYSCAP_RESTRICTEDROOT`-ok opener
(`cdopen` gate). `cdcheckmedia` runs on `open()` / first read.

### Exploit chain

Not developed — the primitive requires a malicious device that is absent on this
guest, and the device node is not reachable by the unprivileged actor. This is the
**valid hard blocker "device-controlled primitive, no malicious device present"**:
the write content is fully attacker-controlled but only a malicious SCSI target can
supply it, and there is no such target here. No userspace-only path can shape the
TOC the trusted QEMU DVD-ROM returns.

### Fix (defense-in-depth, validated to compile)

`fix.diff` caps `num_entries` at `nitems(softc->toc.entries)` (=100) before the READ
TOC and the fixup/conversion loops, turning an uncapped device-driven overflow into a
clean early-out. Validated: applies cleanly and the patched `scsi_da.c`/`scsi_cd.c`
tree builds `nativekernel` `rc=0` with `-Werror -DINVARIANTS` (`fix_build.log`).

### Reproduce

No runnable PoC on this guest (no malicious CD target, `/dev/cd0` not openable by
`maxx`). `build.sh`/`run.sh` are placeholders that document the gate; the
authoritative artifacts are `env.txt` (gate proof), `fix.diff`, and `fix_build.log`.