{
  "finding_id": "DF-2467",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "The verbatim i_create_session (iscsi.c:609-656) searches the lowest unused session slot under sc->lock but executes sc->sessions[n] = sp at :639 AFTER lockmgr(LK_RELEASE) at :635. A deterministic in-window interleave (thread A parked by the interposed lockmgr_release right after the unlock - semantically identical to preemption at that instruction) let a second ISCSISETSES caller run to completion: both were handed sid=0, make_dev(iscsi unit=0) was called twice, sessions[] ended with 1 reachable entry while the TAILQ and nsess counted 2 - the overwritten session is orphaned/leaked with a duplicate dev minor, and a make_dev failure on the duplicate leaves sp->dev NULL for the ism_stop destroy_dev arm. Root-only (control node 0600 root:wheel, iscsi.c:762). Fix (publish the slot under the lock) validated A/B on the same rig: B gets sid=1, sessions[]/TAILQ/nsess consistent.",
  "exploit_chain": "steps: root ioctl ISCSISETSES x2 racing - deterministic interleave on verbatim function; impact is bookkeeping corruption, orphaned sessions and duplicate minors; privesc ceiling: none beyond the filed root-only confusion/leak (no unpriv path - /dev/iscsi is 0600).",
  "evidence": "run.log: A sid=0 B sid=0 (SAME SLOT), sessions used=1 vs TAILQ 2, nsess=2, make_dev unit=0 twice; fixed run: A sid=0 B sid=1, RESULT=clean.",
  "kernel_refs": [
    "sys/dev/disk/iscsi/initiator/iscsi.c:627",
    "sys/dev/disk/iscsi/initiator/iscsi.c:635",
    "sys/dev/disk/iscsi/initiator/iscsi.c:639",
    "sys/dev/disk/iscsi/initiator/iscsi.c:762"
  ],
  "poc_changes": "none - rig worked first after the lockmgr interposition was routed through the out-of-line lockmgr_release (lockmgr is a static inline in sys/lock.h).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_iscsi/gen.sh && make -m /usr/src/share/mk (in dfv_iscsi)",
  "run_cmd": "kldload dfv_iscsi.ko; sysctl kern.dfv_iscsi_run=1; sysctl -n kern.dfv_iscsi_status",
  "code_hash": "3d0faa3a1c4a20009d4e15cd0eb39d4034767d10129fb23f3325bc9d8361f064",
  "notes": "Root-only ioctl (dev /dev/iscsi mode 0600, iscsi.c:762). Not an unpriv path; TOCTOU demonstrated with a deterministic in-window interleave on the verbatim function.",
  "recommended_fix": "move sc->sessions[n] = sp under sc->lock before LK_RELEASE",
  "fix_status": "fixed"
}