{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "ahci_xpt_scsi_disk_io never consults csio->cdb_len: a pass(4) XPT_SCSI_IO CCB with CAM_CDB_POINTER and cdb_len=6 whose CDB buffer ends at a page boundary (next page PROT_NONE) made the kernel read cdb->rw_10 bytes 6..9 past the user buffer: Fatal user address access from kernel mode, fault VA = cdb_page+1, stopped at ahci_xpt_scsi_disk_io+0x8f0 movzwl 0x7(%r13),%ecx - exactly the 16-bit block-count field at cdb+7. The control run (identical CDB, pointer mid-page) completed normally, proving the DISK path is reached and the fault is the OOB read.",
 "exploit_chain": "operator-group /dev/passN + a crafted CCB -> kernel reads up to 10 CDB bytes regardless of cdb_len -> with an unmapped neighbor page: fatal kernel-mode fault (local DoS); with kernel-address cdb_ptr (KASLR bypass): 14 bytes of kernel memory read into FIS fields",
 "evidence": "run.log (control output), panic.txt (fault VA and stopped-at instruction)",
 "kernel_refs": [
  "sys/dev/disk/ahci/ahci_cam.c:1089",
  "sys/dev/disk/ahci/ahci_cam.c:1512"
 ],
 "poc_changes": "live QEMU AHCI hardware (ahci0.0 DISK, /dev/pass0); trigger via libcam CAM_CDB_POINTER CCB; no rig needed",
 "attempts": 2,
 "runtime_sec": 600,
 "guest_dirty": 0,
 "build_cmd": "cc -O -o pass2422 pass2422.c -lcam",
 "run_cmd": "./pass2422 -c   (control: completes) ; ./pass2422  (trigger: panic)",
 "notes": "the ATAPI sibling path already validates cdb_len (ahci_cam.c:1512); the fix mirrors it",
 "recommended_fix": "mirror the ATAPI check in ahci_xpt_scsi_disk_io: reject CCBs with csio->cdb_len < 6 || > 16 before dereferencing the CDB",
 "finding_id": "DF-2422",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "6fd9660adecc109ebac0a83b2158b345bc499ad4db29dbf7f9f01c42fe459389"
}