# DF-2422 VERDICT

**Status:** reproduced
**Impact:** panic
**Confidence:** certain

ahci_xpt_scsi_disk_io never consults csio->cdb_len: a pass(4) XPT_SCSI_IO CCB with CAM_CDB_POINTER and cdb_len=6 whose CDB buffer ends at a page boundary (next page PROT_NONE) made the kernel read cdb->rw_10 bytes 6..9 past the user buffer: Fatal user address access from kernel mode, fault VA = cdb_page+1, stopped at ahci_xpt_scsi_disk_io+0x8f0 movzwl 0x7(%r13),%ecx - exactly the 16-bit block-count field at cdb+7. The control run (identical CDB, pointer mid-page) completed normally, proving the DISK path is reached and the fault is the OOB read.

## Kernel references
- `sys/dev/disk/ahci/ahci_cam.c:1089`
- `sys/dev/disk/ahci/ahci_cam.c:1512`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Notes
the ATAPI sibling path already validates cdb_len (ahci_cam.c:1512); the fix mirrors it

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.