# DF-2271 — scsi_ch.c chgetelemstatus: device-controlled avail walks off buffer

## Verdict: NOT REPRODUCED (hardware-gated) — source bug CONFIRMED real; fix.diff compiles.

**Classification:** `not_reproduced` / HW-gated / impact=none. The OOB-read info-leak
is **real in source**; the defense-in-depth `fix.diff` **compiles cleanly**
(`nativekernel rc=0`, `-Werror`, `-DINVARIANTS`).

### Why not reproduced (the gate)

The bug lives in `chgetelemstatus()` of the **ch(4) medium-changer peripheral**. The
guest has **no medium-changer device**: `camcontrol devlist` shows only the QEMU
DVD-ROM, there is **no `/dev/ch*`** node, and the ch(4) peripheral is not loaded.
The trigger also requires a **malicious SCSI changer** that reports
`READ_ELEMENT_STATUS avail > cesr_element_count`. The unprivileged actor `maxx`
(uid 1001, no privileged groups) cannot reach any of this.

Gate proof (this guest):
```
$ camcontrol devlist   ->  <QEMU QEMU DVD-ROM 2.5+>  (sg0,pass0,cd0)   [no changer]
$ ls /dev/ch*          ->  No such file or directory
$ id maxx              ->  uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
```

### The source bug (real, cited `path:line`)

`sys/bus/cam/scsi/scsi_ch.c`, `chgetelemstatus()`:
- The data buffer for the second READ ELEMENT STATUS is sized for exactly
  `cesr->cesr_element_count` descriptors: `size = sizeof(headers) + desclen *
  cesr->cesr_element_count` (`scsi_ch.c:1120-1122`), `kmalloc(size,...)` (`:1129`).
- But the parse loop iterates `avail = scsi_2btoul(st_hdr->count)` times
  (`scsi_ch.c:1159`, `:1176`) — a **16-bit value fully controlled by the device**.
  `avail != cesr->cesr_element_count` only produces an `xpt_print` warning
  (`:1161-1163`); it is **not clamped**.
- The loop strides `desc` by `desclen` each iteration (`:1181-1182`) and
  `copy_element_status(... desc ...)` reads through it; with `avail > count`, `desc`
  walks past the `data` allocation, leaking adjacent kernel heap. Leaked bytes land
  in the `avail`-sized `user_data` (`:1167`) and are `copyout`-ed to the user
  (`:1186-1188`). `desclen` is also device-controlled (`:1118`), so the surplus
  stride is attacker-tunable.

Attacker model: malicious SCSI medium-changer target. Victim: a process holding the
changer device open.

### Exploit chain

Not developed — no changer target on this guest and `/dev/ch*` absent. This is the
valid hard blocker "device-controlled primitive, no malicious device present"; there
is no userspace-only path to shape `avail`/`desclen` for the trusted (absent)
changer.

### Fix (defense-in-depth, validated to compile)

`fix.diff` clamps `avail` to `cesr->cesr_element_count` when the device over-reports,
so the parse loop can never stride past the allocation. Validated in the combined
`nativekernel` build (`fix_build.log`).

### Reproduce

No runnable PoC on this guest (`/dev/ch*` absent, no malicious changer target).
`build.sh`/`run.sh` document the gate; authoritative artifacts are `env.txt`,
`fix.diff`, `fix_build.log`.