# DF-2412 VERDICT

**Status:** reproduced
**Impact:** none
**Confidence:** likely

Firmware-controlled q_no indexes adv->sense_buffers[q_no-1] with no bound: production adv_intr completed a CHECK_COND entry naming q_no=25 over a 16-entry array, copying the struct at sense_buffers+768 (OOB by construction) into ccb->csio.sense_data with CAM_AUTOSNS_VALID set (kernel heap disclosure window into pass(4)-readable sense data); the q_no=0 variant reads at sense_buffers + 0x1FFFFFFE0 (u_int wrap), also survived and copied 32 zero bytes from that distant KVA. Captured contents were zeros on this heap state both times, so no secret bytes were disclosed in the capture, but the OOB read is mechanically proven (index 24 of a 16-element array; AUTOSNS=1).

## Kernel references
- `sys/dev/disk/advansys/advansys.c:1185`
- `sys/dev/disk/advansys/advansys.c:1108`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Notes
requires control of the AdvanSys HBA LRAM (hostile/compromised card or VM passthrough), hence Low

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.