# DF-2413 VERDICT

**Status:** reproduced
**Impact:** panic
**Confidence:** certain

Same defect family as DF-4349 (this finding is its narrow re-statement at advansys.c:1106-1108): unvalidated ccb_index from firmware LRAM indexes ccb_infos[] and the ->ccb pointer is immediately dereferenced for a write. Re-verified this session on the shipped kernel with the DF-4349 facetB rig: done entry naming ccb_index=10 (in bounds, never allocated, heap-groomed ccb=0x41df41df41df) -> Fatal trap 12, fault VA = 0x41df41df42f3 (poison + offsetof(csio.resid)), stopped at adv_intr+0x101 movl %edi,0x114(%rsi) - the ccb->csio.resid store through the OOB-read pointer. A wild u_int32 index (0x41414141) variant did not fault on this guest (landing zone readable); the in-bounds-unallocated variant above is the demonstrated write primitive.

## Kernel references
- `sys/dev/disk/advansys/advansys.c:1106`
- `sys/dev/disk/advansys/advansys.c:1108`
- `sys/dev/disk/advansys/advlib.c:1988`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Notes
near-duplicate of DF-4349 (verified earlier); the additional claim (u_int32 wild index) did not fault here but needs the same bounds check

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.