{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Production adw_intr CHECK_COND completion with user-supplied sense_len=255 executed the unclamped bcopy at adwcam.c:1321-1322: the 32-byte in-bounds 0xEE fill followed by the planted acb->links.sle_next pointer bytes (48 47 46 45 44 20 42 41 = 0x4142434445464748) and post-acb heap canary (0x6d) landed in ccb->csio.sense_data and past it; ccb->csio.cdb_len was corrupted to 0x47 (a byte of the leaked pointer overwrote it). Both the OOB read (acb tail: kernel pointer + heap) and the OOB write (223 bytes past csio.sense_data into neighboring CCB fields) demonstrated in one production dispatch; guest alive.",
 "exploit_chain": "pass(4) CCB with sense_len=255 + CHECK_COND from target -> bcopy reads acb tail (kernel pointers) into the CAM-visible sense buffer and writes past it corrupting csio fields",
 "evidence": "run.log (before/after sense_data dumps, planted-pointer bytes visible, cdb_len corrupted)",
 "kernel_refs": [
  "sys/dev/disk/advansys/adwcam.c:384",
  "sys/dev/disk/advansys/adwcam.c:1321",
  "sys/dev/disk/advansys/adwcam.c:1322"
 ],
 "poc_changes": "fabricated adw_softc/carriers/acb/ccb exactly as adw_execute_ccb leaves them + real CAM SIM/path registered by the rig (same calls adw_attach makes); production adw_intr from the kernel",
 "attempts": 5,
 "runtime_sec": 1800,
 "guest_dirty": 0,
 "build_cmd": "see build.sh (dfadw.ko)",
 "run_cmd": "sysctl kern.dfadwgo=\"run 255\"",
 "notes": "same root cause class as DF-1510 (adwcam autosense); the mpt driver bounds this exact op with min()",
 "recommended_fix": "cl->sense_len, sizeof(ccb->csio.sense_data));",
 "finding_id": "DF-2416",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "8a00804810367934a9ffc2ccd0c21e5d12e0989165f72ed50cb685aacc739437"
}