{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Production i_setopt with headerDigest=\"CRC32C\": copyinstr(6-byte buffer) copies all 6 chars with no NUL and returns ENAMETOOLONG; the != EFAULT guard admits it; strcmp(hdigest, \"CRC32C\") compares hdigest[6] (adjacent kernel stack, non-NUL) and never matches - demonstrated directly: the production call returned 0 with sess.hdrDigest == NULL, i.e. CRC32C negotiation is silently broken and the strcmp read past the 6-byte stack buffer (the over-read itself). No console leak in the default build (sdebug compiled out), so impact is the functional breakage plus a bounded stack over-read.",
 "exploit_chain": "",
 "evidence": "run.log (production call result: hdrDigest=0, CRC32C rejected)",
 "kernel_refs": [
  "sys/dev/disk/iscsi/initiator/isc_subr.c:126",
  "sys/dev/disk/iscsi/initiator/isc_subr.c:129",
  "sys/dev/disk/iscsi/initiator/isc_subr.c:130"
 ],
 "poc_changes": "production i_setopt via iscsi_initiator.ko symbol; opt struct copyind exactly as the iscsictl ioctl path does",
 "attempts": 4,
 "runtime_sec": 900,
 "guest_dirty": 0,
 "build_cmd": "see build.sh (dfmisc.ko + iscsi_initiator.ko)",
 "run_cmd": "/root/miscctl isopt",
 "notes": "root-only /dev/iscsiN 0600; legacy bucket",
 "recommended_fix": "use digsize 7 (room for 6 chars + NUL) and reject ENAMETOOLONG explicitly",
 "finding_id": "DF-2465",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "c3e6055258a4e7ac392e208f28967a4942c9379a32298d7d7e255178ea9d82ec"
}