# DF-2281 — scsi_sg.c sgwrite size_t->int truncation of uio_resid

## Verdict: NOT REPRODUCED (permission-gated) — source bug CONFIRMED real; fix.diff compiles.

**Classification:** `not_reproduced` / permission-gated for the unprivileged actor /
impact=none. The truncation bug is **real in source**; the defense-in-depth `fix.diff`
**compiles cleanly** (`nativekernel rc=0`, `-Werror`, `-DINVARIANTS`).

### Why not reproduced (the gate)

`sgwrite()` is the write(2) handler of the **sg(4) SCSI-passthrough peripheral**.
The guest has an sg node (`/dev/sg0`, mode `0600 root:operator`) on the QEMU DVD-ROM,
but it is **root-only**. The unprivileged actor `maxx` (uid 1001, in **no** privileged
group — not `operator`, not `wheel`) cannot open `/dev/sg0`, so the `sgwrite` path is
unreachable. (The finding's own threat model is the `operator` group via mode 0660;
this guest uses 0600, closing even that.)

Gate proof (this guest):
```
$ ls -la /dev/sg0
crw-------  root operator  /dev/sg0      # mode 0600 — root only
$ id maxx   ->  uid=1001(maxx) ... groups=1001(maxx)   [not operator]
$ (as maxx) camcontrol devlist -> couldn't open /dev/xpt0: Permission denied
```

### The source bug (real, cited `path:line`)

`sys/bus/cam/scsi/scsi_sg.c`, `sgwrite()`:
- `int error = 0, cdb_len, buf_len, dir;` (`scsi_sg.c:648`) — `buf_len` is `int`.
- `buf_len = uio->uio_resid;` (`scsi_sg.c:698`) — **size_t (64-bit) silently
  truncated into int**. A `write()` whose residual after the 37-byte header+CDB has
  bit 31 set yields a negative `buf_len`.
- `buf = kmalloc(buf_len, M_DEVBUF, M_WAITOK | M_ZERO);` (`:700`) — `kmalloc` takes
  `size_t`, so the negative int is sign-extended to a huge size. The `M_ZERO`
  fast-path in `sys/sys/malloc.h` unconditionally calls `__builtin_memset(_, 0, _)`
  when `(M_WAITOK|M_NULLOK)==M_WAITOK`, so a NULL/oversized allocation panics inside
  `memset` before the caller ever checks. (The `nbytes` clamp in
  `sys/kern/sys_generic.c:336-337` is overwritten at `:349`; `writev` bypasses it
  entirely.)
- Same defect on the `else if (hdr->reply_len != 0)` branch (`:705-707`): the
  user-controlled `int hdr->reply_len` is passed unsanitized to `kmalloc`.

Attacker model (per finding): a member of the `operator` group on a system where
`/dev/sgN` is 0660. On this guest the node is 0600 root-only, so the unprivileged
path is closed.

### Exploit chain

Not developed — `/dev/sg0` is 0600; `maxx` cannot open it, so there is no
unprivileged trigger. A root trigger would be root→kernel (game-over by definition),
not an escalation. Valid hard blocker for the unprivileged model: the device node is
not openable by the actor.

### Fix (defense-in-depth, validated to compile)

`fix.diff` rejects `uio_resid > INT_MAX` and `buf_len < 0` before the `kmalloc`, and
bounds the user-controlled `hdr->reply_len` to `[0, MAXPHYS]`. Validated in the
combined `nativekernel` build (`fix_build.log`).

### Reproduce

No runnable PoC for the unprivileged actor (`/dev/sg0` is 0600). Artifacts:
`env.txt`, `fix.diff`, `fix_build.log`.