# DF-2461 — `i_prepPDU` truncates PDU length to `u_int`; `maxBurstLength` accepts negative

## Verdict
**REPRODUCED** — a root-only kernel memory-corruption primitive via the
`ISCSISEND` ioctl. The two cited integer defects are both real and confirmed:
`i_setopt()` accepts a **negative** `maxBurstLength` (only `!= 0` is guarded),
which disables `i_prepPDU()`'s E2BIG safety net, and `i_prepPDU()` stores a
64-bit `size_t` length into the 32-bit `pq->len` without an overflow check.
On the default GENERIC kernel (INVARIANTS ON) the resulting corruption
manifests as a deterministic kernel panic. Fix **validated** on a rebuilt module.

### Privilege / impact ceiling (Phase 6 honesty)
- **Trigger requires root.** `ISCSISEND` is dispatched from `iscsi_ioctl()`
  (`iscsi.c:234`) with **no internal privilege check**, but `/dev/iscsi*` is
  created `UID_ROOT, GID_WHEEL, 0600` (`iscsi.c:641,762`), so only root can
  issue it. Root→kernel is game-over by definition (root can `kldload`), so
  this is **not** an unprivileged→root escalation; it is a hardening /
  defense-in-depth defect. There is no unprivileged path: the ISCSISEND
  overflow needs a root-opened fd, and `i_prepPDU`'s outgoing-PDU truncation
  only matters for attacker-controlled `ahs_len`/`ds_len` (the CAM-generated
  SCSI-CMD path uses small fixed sizes). This is the "write reachable only from
  an already-root context" valid hard blocker for an *escalation* claim.
- The demonstrated effect on GENERIC is therefore **panic (DoS)** from a
  privileged user; on a noinv kernel it would be a silent heap/mbuf overflow
  (still root-only).

## Mechanism (the negative-maxBurstLength bypass → mbuf overflow)
1. `i_setopt()` (`isc_subr.c:99`) stores `maxBurstLength` with only an
   `if(opt->maxBurstLength != 0)` guard, so `maxBurstLength = -1` is accepted.
2. `i_prepPDU()` (`isc_sm.c:293`) computes `len` as `size_t`, then tests
   `if(sp->opt.maxBurstLength && (len > sp->opt.maxBurstLength))`. With
   `maxBurstLength == -1` (int) and `len` (size_t), the int is converted to
   `(size_t)0xFFFFFFFFFFFFFFFF`, so the comparison is always false — **E2BIG is
   never returned** for any size.
3. `i_send()` (`iscsi.c:461`) proceeds; `isc_qout()` queues the PDU;
   `proc_out()` → `isc_sendPDU()` (`isc_soc.c:120`) does
   `bcopy(pp->ahs, mh->m_data + mh->m_len, pp->ahs_len)`. The mbuf header has
   only `~MHLEN` bytes of room, so a 70000-byte AHS overflows it.

### The truncation (separate, same routine)
`i_prepPDU()` (`isc_sm.c:291`) does `pq->len = len;` where `len` is `size_t`
(64-bit) and `pq->len` is `u_int` (32-bit, `iscsivar.h:182`). Choosing
`ahs_len=200, ds_len=0xFFFFFF68` makes `len = 0x100000060`, which truncates to
`pq->len = 0x60 = 96`; then `i_send()` does `kmalloc(96-48=48)` (kmalloc-64
chunk) but `copyin(pp->ahs, bp, 200)` — a 152-byte heap overflow. On GENERIC
this is silently corrupted into adjacent slab chunks (copyin traps any
slab-page-boundary fault and returns EFAULT, so no immediate panic unless the
neighbour chunks are later alloc/freed and INVARIANTS catches them).

## Evidence
**Baseline (unpatched `#0`) — negative-maxBurstLength bypass → mbuf overflow panic:**
```
>>> i_prepPDU: 0] pdu len=70000 > 65536     <- test (A): default maxBurst -> E2BIG (correct)
panic: overflowed mbuf 0xfffff801187af400    <- test (A2): maxBurst=-1 -> bypass -> isc_sendPDU overflow
cpuid = 3
m_free() at m_free+0x351
m_freem() at m_freem+0x15
sosend() at sosend+0xf1
isc_sendPDU() at isc_sendPDU+0xa12
ism_proc() at ism_proc+0x3ee
Stopped at Debugger+0x7c
```
(The `(A)` line is the default-maxBurst case correctly returning E2BIG; `(A2)`
sets `maxBurstLength=-1`, bypasses E2BIG, and the oversized AHS overflows the
mbuf header in `isc_sendPDU`.)

Reproduced by `df2461` (root ioctl driver) + `mtarget hold` (keeps the session
socket connected so `i_send` does not short-circuit with ENOTCONN). See
`panic.txt` for the full trace.

## PoC changes
- `mtarget.c` (new): malicious-target harness; `hold` mode keeps the TCP
  connection open so `ISCSISETSOC` sets `sp->soc` for the ISCSISEND path.
- `df2461.c` (new): root ioctl driver demonstrating (A) E2BIG with default
  maxBurst, (A2) the negative-maxBurst bypass, and (B) the size_t→u_int
  truncation. Includes the kernel `iscsi.h` (matches `sizeof(pdu_t)=96`,
  `sizeof(isc_opt_t)=208`) for correct ioctl encoding.
- `fix.diff` (new): two-part fix.

## Fix (`fix.diff`) — two logical changes
1. `isc_subr.c:99` `i_setopt()`: change the guard from `!= 0` to `> 0`, so a
   negative `maxBurstLength` is rejected (the default 65536 is kept). This also
   makes the `len > sp->opt.maxBurstLength` comparison in `i_prepPDU` correct
   (no sign-extension to a huge size_t).
2. `isc_sm.c:291` `i_prepPDU()`: reject `len > 0xffffffff` (E2BIG) before the
   `pq->len = len` truncation, so a wrapped length cannot produce an undersized
   `kmalloc` followed by a full-length `copyin`.

**Matches** the finding markdown's `## Recommended fix` proposal (which
identified both the truncation and the negative-acceptance); this implements
both at the exact lines with return-E2BIG semantics.

## Fix validation (rebuilt single module)
- Baseline (unpatched `#0`): test (A2) → `panic: overflowed mbuf` in
  `isc_sendPDU` (panic.txt).
- Patched module (sha256 `b5181f50...`): all three tests return **E2BIG** cleanly
  — (A) oversized/default-maxBurst → E2BIG; (A2) negative `maxBurstLength`
  rejected (stays default) → E2BIG; (B) wrapped length → E2BIG, dmesg shows
  `">>> i_prepPDU: 0] pdu len=4294967392 exceeds 32 bits"`. No panic, guest up.