{
  "finding_id": "DF-2471",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "limited_write",
  "confidence": "certain",
  "verdict": "The verbatim isp_parse_async (isp.c:5436-5607) reads chan = ISP_READ(isp, OUTMAILBOX6) with no validation when IS_DUALBUS, then uses chan in ISP_SET_SENDMARKER and SDPARAM writes. With a 2-channel (nchan=2, isp_param = 408 bytes + guard) 12160 dual-bus card and a firmware-reported channel of 5, the ASYNC_BUS_TRANSIT arm wrote SDPARAM(isp,5)->isp_diffmode/ultramode/lvdmode at byte offset 1020..1224 - 614 bytes past the isp_param allocation into the guard (smashed=1, first@+614). Controls (chan 0/1) clean. The ASYNC_BUS_RESET arm only flips the sendmarker bitfield and landed inside a guard byte without changing it (noted honestly); the TRANSIT arm is the demonstrated OOB write. The FC path validates the same value via GET_24XX_BUS (isp.c:5609+). Requires faulty/compromised ISP firmware (mailbox data), i.e. PCI-level trust, as filed. Fix (reject chan >= isp_nchan) A/B: guard smashed=0.",
  "exploit_chain": "no realistic unpriv/remote path - firmware-reported value; impact is an OOB write into adjacent driver data from a malfunctioning card.",
  "evidence": "run.log: TRANSIT chan=5 -> guard smashed=1 first@+614; chan=5 RESET -> no observable change (bitfield); fixed: smashed=0 RESULT=clean.",
  "kernel_refs": [
    "sys/dev/disk/isp/isp.c:5444",
    "sys/dev/disk/isp/isp.c:5449",
    "sys/dev/disk/isp/isp.c:5475",
    "sys/dev/disk/isp/ispvar.h:646",
    "sys/dev/disk/isp/isp.c:5609"
  ],
  "poc_changes": "rig fabricates mdvec register accessors; ISP_SET_SENDMARKER/SDPARAM macros operate on the real guarded allocation.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 600,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_isp/gen.sh && make -m /usr/src/share/mk (in dfv_isp)",
  "run_cmd": "kldload dfv_isp.ko; sysctl kern.dfv_isp_run=3; sysctl -n kern.dfv_isp_status",
  "code_hash": "3b5a633bf81f60910f8365526434e7ffc6562dfe622810fcd4f2e05b92e466bb",
  "notes": "RESET-arm bitfield store (sendmarker) landed inside an 0xAA guard byte and did not change it; the TRANSIT arm writes full fields and smashed the guard - that arm is the demonstrated OOB write. FC path contrast: GET_24XX_BUS guard at isp.c:5609.",
  "recommended_fix": "reject async events whose OUTMAILBOX6 channel >= isp_nchan",
  "fix_status": "fixed"
}