{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Firmware-controlled q_no indexes adv->sense_buffers[q_no-1] with no bound: production adv_intr completed a CHECK_COND entry naming q_no=25 over a 16-entry array, copying the struct at sense_buffers+768 (OOB by construction) into ccb->csio.sense_data with CAM_AUTOSNS_VALID set (kernel heap disclosure window into pass(4)-readable sense data); the q_no=0 variant reads at sense_buffers + 0x1FFFFFFE0 (u_int wrap), also survived and copied 32 zero bytes from that distant KVA. Captured contents were zeros on this heap state both times, so no secret bytes were disclosed in the capture, but the OOB read is mechanically proven (index 24 of a 16-element array; AUTOSNS=1).",
 "exploit_chain": "HBA LRAM/firmware controls q_no -> sense_buffers[q_no-1] struct-copied into user-visible sense data: kernel heap read window up to a 128GB span at 32-byte granularity",
 "evidence": "run.log (AUTOSNS=1 dumps for q_no=25 and q_no=0)",
 "kernel_refs": [
  "sys/dev/disk/advansys/advansys.c:1185",
  "sys/dev/disk/advansys/advansys.c:1108"
 ],
 "poc_changes": "df43xx rig (DF-4349 harness) extended with a status-parameterized done-queue entry and the two q_no scenarios; production adv_intr dispatched over fabricated post-attach state",
 "attempts": 2,
 "runtime_sec": 600,
 "guest_dirty": 0,
 "build_cmd": "see build.sh (df43xx_rig.ko extension)",
 "run_cmd": "sh primeadv.sh; sysctl kern.df43xx.go=12; sysctl kern.df43xx.go=13",
 "notes": "requires control of the AdvanSys HBA LRAM (hostile/compromised card or VM passthrough), hence Low",
 "recommended_fix": "validate q_no in adv_done/adv_run_doneq: if (q_no == 0 || q_no > adv->max_openings) drop the completion",
 "finding_id": "DF-2412",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "a627642d5eaaac490f2bf7479d002d55cc939a9bda011c3bccbb689577d581ec"
}