{
 "finding_id": "DF-2345",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Both fabrication blocks verbatim (umass.c EVPD serial at :2321-2335, page-list append in umass_cam_cb at :2578-2591) against canary-banded CCB buffers: with dxfer_len=8 and a 35-char iSerialNumber the serial path writes 31 bytes past the buffer (the 100-char variant 96 bytes, clamped only at the struct field 251); the page-list path with a device-supplied length byte of 200 in a 68-byte buffer writes at offset 204, 137 bytes past the end, because the bound is the struct field, not dxfer_len. The dxfer_len=255 control keeps every write in bounds. With the clamps both paths leave the sentinels intact. The write primitive is real but contained by the rig page; exposure needs a malicious mass-storage device plus a CAM initiator issuing a short-buffer EVPD INQUIRY (pass(4)/CAMIOCOMMAND gives the small dxfer_len).",
 "exploit_chain": "",
 "evidence": "run_fixed_kernel.log and session baseline (OOB WRITE PROVEN: bytes [8..38] / [8..103] / [204..204] past dxfer_len; controls INTACT), rig/dfbatch_umass.c, fix.diff",
 "kernel_refs": [
  "sys/bus/u4b/storage/umass.c:2327",
  "sys/bus/u4b/storage/umass.c:2330",
  "sys/bus/u4b/storage/umass.c:2588",
  "sys/bus/u4b/storage/umass.c:2589"
 ],
 "poc_changes": "pagelist scenario initially used an empty iSerialNumber (skips the block) and cmd_data[2]=0x80 (wrong page); fixed to a non-empty serial and SVPD_SUPPORTED_PAGE_LIST",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 900,
 "guest_dirty": 0,
 "build_cmd": "kernel-compiled rig (DFBATCH)",
 "run_cmd": "sysctl debug.dfbatch.cmd=\"umass <serial|serial255|pagelist|control>\"",
 "code_hash": "439901313921ee30ffe4b019f7ef200fe4bd0628cb9ffa74c3ce5be34c60dc00",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "clamp the serial fabrication and the page-list append to csio->dxfer_len"
}