{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Same defect family as DF-4349 (this finding is its narrow re-statement at advansys.c:1106-1108): unvalidated ccb_index from firmware LRAM indexes ccb_infos[] and the ->ccb pointer is immediately dereferenced for a write. Re-verified this session on the shipped kernel with the DF-4349 facetB rig: done entry naming ccb_index=10 (in bounds, never allocated, heap-groomed ccb=0x41df41df41df) -> Fatal trap 12, fault VA = 0x41df41df42f3 (poison + offsetof(csio.resid)), stopped at adv_intr+0x101 movl %edi,0x114(%rsi) - the ccb->csio.resid store through the OOB-read pointer. A wild u_int32 index (0x41414141) variant did not fault on this guest (landing zone readable); the in-bounds-unallocated variant above is the demonstrated write primitive.",
 "exploit_chain": "firmware LRAM ccb_index -> ccb_infos[idx].ccb (OOB read) -> ccb->csio.resid write at attacker-groomed address -> kernel memory write primitive -> panic or corruption",
 "evidence": "panic.txt (fault VA = groom + offsetof(csio.resid), stopped at the resid store)",
 "kernel_refs": [
  "sys/dev/disk/advansys/advansys.c:1106",
  "sys/dev/disk/advansys/advansys.c:1108",
  "sys/dev/disk/advansys/advlib.c:1988"
 ],
 "poc_changes": "existing DF-4349 rig re-run; no changes",
 "attempts": 1,
 "runtime_sec": 200,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "sh primeadv.sh; sysctl kern.df43xx.go=3",
 "notes": "near-duplicate of DF-4349 (verified earlier); the additional claim (u_int32 wild index) did not fault here but needs the same bounds check",
 "recommended_fix": "bounds+state check before deref: if (ccb_index >= adv->max_openings || cinfo->state != ACCB_ACTIVE) drop the completion (the DF-4349 fix covers this)",
 "finding_id": "DF-2413",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "d040535b451b92806b9dcbfad3916b5d5b37911cf05161c3331a03dfb87b72b0"
}