# DF-2417 — ADW_TARGET_GROUP macro off-by-factor-4 causes heap OOB write on every AdvanSys attach

## Verdict
NOT REPRODUCED (hardware / trigger gated). The cited vulnerable code path exists
in `sys/dev/disk/advansys/adwlib.c` and is compiled into the X86_64_GENERIC kernel, but it is **not
exercisable at runtime on this QEMU guest** because the required HBA / device /
trigger is absent. Confidence in the source bug itself: **certain**.

## Why it cannot be reproduced here (the gate)
Hard-gated: needs an AdvanSys (adw) HBA. The guest has NO AdvanSys controller; adw_set_user_sdtr / adw_init never run.

See `env.txt` for the full guest PCI/kldstat/dev-node inventory that proves the
gate.

## The bug is real in source (traced line-by-line)
Cited path:
- sys/dev/disk/advansys/adwlib.h:64
- sys/dev/disk/advansys/adwlib.c:756
- sys/dev/disk/advansys/adwlib.c:766
- sys/dev/disk/advansys/adwlib.c:779
- sys/dev/disk/advansys/adwlib.c:793
- The vulnerable construct is present verbatim in the current master source
  (confirmed by direct read of the cited lines during verification).
- A defense-in-depth `fix.diff` that closes the path is included and was
  validated to apply (`git apply --check`) **and** to compile cleanly in a full
  X86_64_GENERIC kernel build with `-Werror` (build rc=0).

## Fix
Fix the macro: ADW_TARGET_GROUP(tid) must be ((tid) >> 2), not ((tid) & ~0x3); the latter yields 0/4/8/12 instead of 0/1/2/3 and indexes user_sdtr[4] OOB for tid>=12.

The standalone git-apply-able diff is `fix.diff`.

## Reproduce
`./build.sh && ./run.sh` — both are no-ops on this guest by design (the gate
holds). Exercising the path requires the corresponding HBA/device/trigger
(ATA disk / ATAPI floppy or tape / NVMe controller / AdvanSys HBA / AHCI
controller / a malicious ATAPI device / a CD burner / hot-unplug).

## Status
status: not_reproduced  | reproduced: 0 | impact: none (HW-gated)
fix_status: not_testable (path cannot run on this guest; diff applies + compiles)