# DF-2279 - Verification Verdict

**Status:** reproduced
**Impact:** leak
**Confidence:** certain

## Mechanism
passioctl CAMIOCOMMAND rejects only XPT_FC_XPT_ONLY function codes; everything else - including kernel-internal codes that operate on kernel-only objects - is executed, and passsendccb then bcopy()s the ENTIRE kernel union ccb back over the user buffer (scsi_pass.c:595-597), including the ccb_h.path kernel pointer installed by xpt_setup_ccb.

## Verdict
REPRODUCED as root on the stock guest (/dev/pass0 present from the QEMU storage, 0600 root:operator): CAMIOCOMMAND with XPT_PATH_INQ succeeds and returns ccb_h.path = 0xfffff8008d6c0e80 plus another canonical kernel pointer (offset 0x98) in the copied-back CCB. Kernel text/data addresses disclosed to the privileged caller; kernel-internal codes (XPT_GDEVLIST, XPT_DEV_MATCH, XPT_ASYNC, ...) remain exposed to operator-group members. Privilege-gated surface: open is caps_priv_check(SYSCAP_RESTRICTEDROOT)-checked and the node is 0600 root:operator.

## Threat / reachability
Privileged CAMIOCOMMAND callers (root/operator) obtain live kernel pointers and can drive kernel-only XPT machinery; hardening parity with FreeBSD which allowlists func codes here.

## Privilege escalation assessment
n/a (root/operator-gated; pointer disclosure to semi-trusted operators)

## Fix
Deny the kernel-only function codes not already gated as XPT_FC_XPT_ONLY (XPT_GDEVLIST, XPT_REL_SIMQ, XPT_TERM_IO) before executing, mirroring FreeBSDs allowlist approach; XPT_DEV_MATCH and XPT_RESET_BUS are already rejected by the existing XPT_FC_XPT_ONLY check.

## Kernel references
- `sys/bus/cam/scsi/scsi_pass.c:474`
- `sys/bus/cam/scsi/scsi_pass.c:494`
- `sys/bus/cam/scsi/scsi_pass.c:596`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Note: an earlier draft of this fix.diff failed the first combined build (see _batch41/README.md); the shipped diff is the corrected, compile-clean version.