======================================================================
Guest environment — DragonFlyBSD 6.5-DEVELOPMENT audit guest (with-src)
======================================================================

uname -a:
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

Kernel: X86_64_GENERIC (default), #0 build = the unpatched audit-source kernel.

Loaded kernel modules (kldstat):
  Id Refs Address                Size Name
   1    5 0xffffffff80200000  1ad8538 kernel
   2    1 0xffffffff81cd9000    7c288 ehci.ko
   3    1 0xffffffff81d56000    8c778 xhci.ko
  => NO advansys, adwcam, amd, bt(buslogic), mpt, mfi, mpr, mps, isp, trm, sym,
     sili, sbp, ahci-mpt-isp module loaded. The HBA drivers cited by
     DF-2411/2415/2424/2428 are not present in the running kernel and there is
     no matching PCI hardware to attach them to (see pciconf below).

camcontrol devlist (CAM-attached targets):
  <QEMU QEMU DVD-ROM 2.5+>  at scbus1 target 0 lun 0  (sg0,pass0,cd0)
  => The ONLY CAM peripheral is the QEMU DVD-ROM, reached via the PIIX3 IDE
     controller (atapci0 / ata-cam), NOT a SCSI HBA. There is no SCSI HBA at
     all, and no direct-access disk (da) or medium-changer (ch) target.

/dev SCSI peripheral nodes:
  crw-r-----  root operator  /dev/cd0     (mode 0640 — owner root, group operator)
  crw------- root operator  /dev/pass0    (mode 0600 — root only)
  crw------- root operator  /dev/sg0      (mode 0600 — root only)
  crw------- root operator  /dev/sga      (mode 0600 — root only)
  crw------- root operator  /dev/xpt0     (mode 0600 — root only)
  (no /dev/da*, no /dev/ch*)

pciconf -l (mass-storage / bridge devices):
  isab1@pci0:0:1:0    class=0x060100  Intel 82371SB PIIX3 ISA bridge
  atapci0@pci0:0:1:1  class=0x010180  Intel 82371AB PIIX3 IDE (WDMA2)  <- the cd0 parent
  virtio_pci1@pci0:0:4:0 class=0x010000  virtio block (the root disk, vtblk, NOT SCSI)
  => NO AdvanSys (0x10cd/0x1217 etc.), NO AMD 53c974 (0x1022/0x2020), NO BusLogic
     (0x104b/*), NO LSI/Symbios/LSI53c895a, NO AHCI. The four HBA-driver
     findings (advansys/adwcam/amd/bt) have no hardware to bind.

Unprivileged user (the PoC actor):
  id maxx  =>  uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
  maxx is in NO privileged group (not wheel, not operator).

Unprivileged reachability probe:
  $ su -m maxx -c "camcontrol devlist"
  camcontrol: couldn't open /dev/xpt0: Permission denied
  $ (as maxx) test -r/w on /dev/xpt0 /dev/sg0 /dev/cd0 /dev/pass0  => NO_ACCESS for all.

dmesg HBA scan (grep advansys|adw|amd|buslogic|bt|sili|trm|sym|mpt|isp|ahci|mfi|mpr|mps):
  (no matches for any SCSI HBA driver — only the ata-cam cd0 path)