# DF-2469 — Heap OOB write via double channel offset in RQCS_SYNCXFER_FAILED

## Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

## Hardware gate

No QLogic ISP (FC/SCSI) HBA is present in this QEMU/KVM guest:
- `kldstat`: only `kernel`, `ehci.ko`, `xhci.ko` — no `isp.ko` module loaded
- `pciconf -l`: only PIIX3 IDE (`atapci0`), virtio-net, virtio-blk — no QLogic PCI device
- `camcontrol devlist`: only QEMU DVD-ROM

The isp driver cannot attach, so the cited code path (`isp.c` RQCS_SYNCXFER_FAILED
handler) is never reached at runtime. This is a **latent source bug** that can
only fire on real (or emulated) QLogic ISP1080/1240/1280/12160 dual-bus hardware.

## Source trace (confirmed real bug)

**File:** `sys/dev/disk/isp/isp.c:6282-6283`

```c
case RQCS_SYNCXFER_FAILED:
    ...
    if (IS_SCSI(isp)) {
        sdparam *sdp = SDPARAM(isp, XS_CHANNEL(xs));  // line 6282: indexes by channel
        sdp += XS_CHANNEL(xs);                          // line 6283: double-applies channel offset ← BUG
        sdp->isp_devparam[XS_TGT(xs)].goal_flags &= ~DPARM_SYNC;
```

The sibling handler `RQCS_WIDE_FAILED` at lines 6266-6273 uses the same pattern
but **without** the erroneous `sdp += XS_CHANNEL(xs)` line — confirming the extra
line at 6283 is a bug, not intentional. For a dual-bus card (`isp_nchan=2`),
`isp_param` has 2 `sdparam` entries. `SDPARAM(isp, 1)` returns `&isp_param[1]`,
then `sdp += 1` moves to `&isp_param[2]` — one past the end — and the subsequent
16-bit read-modify-write corrupts adjacent heap.

## Fix

Removed the erroneous `sdp += XS_CHANNEL(xs);` line. See `fix.diff`.

## Impact (on HW that has the HBA)

Medium — heap OOB write of ~8 bytes (goal_flags RMW) at a controlled offset
(~256 bytes range via XS_TGT). Requires a dual-bus ISP SCSI adapter with an
active command completing with SDTR failure on channel 1.