{
  "finding_id": "DF-2276",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED exactly as claimed, mechanically through the real dispatch on the shared harness kernel, plus one aggravating discovery. (1) del_num[1]=LLONG_MIN is 512-aligned and passes both KKASSERTs; byte_count = MIN(bytes_left, 0x7FFF8000) keeps LLONG_MIN and the assignment to int byte_count truncates to 0, so every iteration dispatches a zero-block TRIM while bytes_left is unchanged: 200001 bios observed through the FULL real path (200000 consecutive zero-range XPT_TRIM CCBs, all b_bcount=0 and bio_offset=0) at ~2.2M iterations/s, and 1000001 bios at ~9.5M/s in capture mode, each iteration doing one getnewbuf (vfs.getnewbufcalls delta 200006); only the harness watchdog (EIO exit) ended the runs - unmodified the ioctl never returns, never checks signals, and pins a CPU: privileged-reach unkillable DoS. (2) del_num[1]=-4096 (also 512-aligned) reaches dev_dstrategy with bp->b_bcount = -4096 (0xfffff000), captured at the dispatch boundary; the ioctl then returns SUCCESS. Aggravation: dastart computes count = bp->b_bcount / softc->params.secsize as int divided by u_int32_t, i.e. UNSIGNED, turning -4096 into 8388599 positive sectors, so the real driver builds a 129-range ~4GiB TRIM (dxfer_len 1536 = ((129+63)/64)*512) for a minus-4KB request - on real hardware a misdirected multi-GiB TRIM (privileged data destruction). Team directive closed: NO kernel memory corruption - the negative b_bcount never becomes a copy size; the dastart range builder writes at most 129 descriptors into the 512-descriptor trim_req.data, the merge-limit check bounds totals to 512, and the FREEBLKS path never feeds b_bcount to scsi_read_write; residual impact is DoS + wrong-range TRIM, both gated by the daopen SYSCAP_RESTRICTEDROOT check. Fix validated A/B: negatives and LLONG_MIN now return EINVAL instantly with nothing dispatched, aligned control unchanged.",
  "exploit_chain": "",
  "evidence": "run.log holds all four decisive runs (neg full path with cap[0] bcount=-4096 and the 129-range TRIM capture; neg capture mode; both llmin watchdog runs with all-zero counters) plus the fixed-kernel EINVAL results and the getnewbuf delta; getnewbuf_before.txt/getnewbuf_after.txt; VERDICT.md decodes the unsigned-division arithmetic; shared rig in ../DF-2275/rig (run_baseline_outer.log is the raw suite output).",
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_da.c:436",
    "sys/bus/cam/scsi/scsi_da.c:449",
    "sys/bus/cam/scsi/scsi_da.c:462",
    "sys/bus/cam/scsi/scsi_da.c:463-481",
    "sys/bus/cam/scsi/scsi_da.c:1341",
    "sys/bus/cam/scsi/scsi_da.c:1345-1368",
    "sys/bus/cam/scsi/scsi_da.c:505",
    "sys/bus/cam/scsi/scsi_daio.h:38"
  ],
  "poc_changes": "No seed PoC existed; the trigger da_user.c and the shared CAM verbatim-interposition rig (see DF-2275 poc_changes) were written from scratch; the watchdog sysctl (force EIO after N bios) was added so the infinite loop terminates with decisive iteration and allocation counters instead of hanging the guest.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Sun Oct 18 01:07:00 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cd ../DF-2275/rig && ./build.sh (shared harness kernel)",
  "run_cmd": "vm.sh run_root sysctl debug.dfda.setup=1; vm.sh run_root sysctl debug.dfda.mode=1; vm.sh run_root sysctl debug.dfda.watchdog=200000; vm.sh run_root /root/da_user llmin; vm.sh run_root /root/da_user neg; vm.sh run_root sysctl debug.dfda.stats",
  "code_hash": "d490a01c2284caa9d0512cea3283e3e7ade0c03a130745c315a3069d398f2af0",
  "notes": "Corruption-adjacent analysis (team directive): the negative struct-buf length genuinely reaches the real da strategy (captured), but CAM/dastart structurally defuse it kernel-side (unsigned division caps count at 8388607 sectors, <= 129 of 512 range slots, no b_bcount-sized copies on the FREEBLKS path) - closed as no memory corruption; flagged residual: misdirected multi-GiB TRIM on real hardware. FreeBSD canonical DIOCGDELETE rejects misalignment and length <= 0 with EINVAL up front (sys/geom/geom_dev.c:609-618) and loops while (length > 0); the validated fix matches that rejection set, with the noted divergence that DragonFly keeps while (bytes_left). Guest was reset with-src after the run.",
  "recommended_fix": "Reject negative del_num[0]/del_num[1] up front and return EINVAL for misaligned ranges in daioctl (fix.diff, validated A/B; shared with DF-2275).",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #2: Sun Oct 18 01:35:38 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Single-fix kernel (fix.diff shared with DF-2275) A/B tested: llmin returns errno 22 instantly with strat_count=0 (baseline: 200001+ bios and only the watchdog stopped it), neg returns errno 22 with nothing dispatched (baseline: negative b_bcount and a 129-range TRIM), aligned control {0,4096} still succeeds through the real path with a byte-identical CDB.",
  "fix_evidence": "fix_run.log and run.log fixed sections (neg/llmin EINVAL with strat_count=0, aligned control CDB); rig/run_fixed_outer.log (full suite output)."
}