{
  "finding_id": "DF-2286",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "REPRODUCED on the BUSAUDIT kernel with the targsim fake-SIM rig: after writing an ATIO and completing it via the real CAM path, the daemon reads its own CCB pointer back and finds uccb.ccb_h.cbfcnp = 0xffffffff802c8ff0 -- exactly nm(kernel.debug) targdone -- and uccb.ccb_h.path = 0xfffff8008d6c0fa0 (kernel-realm cam_path heap pointer). targreturnccb (scsi_target.c:967-969) copyouts the [retry_count, periph_priv) slice of the kernel ccb_hdr without sanitizing cbfcnp (unconditionally &targdone via :769/:1001) or path (xpt_setup_ccb :999), defeating KASLR for every completed ATIO/INOT/CTIO. Sibling driver scsi_pass.c:610 NULLs cbfcnp before its copy-back; scsi_target.c does not. RESTRICTEDROOT gated (/dev/targ clone is 0600 root:wheel).",
  "exploit_chain": "",
  "evidence": "run.log: cbfcnp 0xffffffff802c8ff0 with nm targdone ffffffff802c8ff0 t targdone in the same log; path 0xfffff800... (kernel heap); read() returned the exact user_ccb pointer submitted",
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_target.c:967",
    "sys/bus/cam/scsi/scsi_target.c:968",
    "sys/bus/cam/scsi/scsi_target.c:769",
    "sys/bus/cam/scsi/scsi_target.c:999",
    "sys/bus/cam/scsi/scsi_target.c:1001",
    "sys/bus/cam/scsi/scsi_pass.c:610"
  ],
  "poc_changes": "Authored from scratch on the DF-5375 targsim rig (no seed). Fixed a compound-literal sysctl write, the sysctl name (hw.targsim.complete not hw.targsim_complete), and offsetof usage (__builtin_offsetof). A first run panicked inside targsim ev_sysctl_complete because a prior aborted run left a stale held ATIO from a closed fd -- the canonical single-fd choreography on a fresh boot is deterministic.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Wed Oct 21 11:04:42 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/BUSAUDIT x86_64 (stock GENERIC + device targ; INVARIANTS)",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "make KERNBUILDDIR=/usr/obj/usr/src/sys/BUSAUDIT ; cc -O -Wall -o poc2286 poc2286.c",
  "run_cmd": "kldload ./targsim.ko; sleep 3; ./poc2286",
  "code_hash": "b9cb1e8b8d2f3842b4c8c01ae1f513a2c8b859105c62fdb4e1adec3cd4505b22",
  "notes": "targ driver requires a custom kernel (device targ); stock GENERIC lacks it (no /dev/targ, no module).",
  "recommended_fix": "Stage the copyout slice in a local ccb_hdr, NULL cbfcnp and path in the staging copy (mirrors scsi_pass.c:610) -- fix.diff.",
  "fix_status": "fixed",
  "fix_validation": "fix kernel: same PoC prints cbfcnp = 0x0000000000000000 and path = 0x0000000000000000 (sanitized); A/B: 0xffffffff802c8ff0 -> 0"
}