# DF-2473 verdict -- isp_handle_platform_atio copies firmware CDB length unbounded (target mode)

status: reproduced   reproduced: 1   impact: limited_write
confidence: certain   attempts: 1   runtime_sec: 600

Compiled with ISP_TARGET_MODE (the only configuration in which this code exists - no in-tree build defines it), the verbatim isp_handle_platform_atio runs ISP_MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, aep->at_cdblen) with at_cdblen a firmware uint8_t (ATIO_CDBLEN = 26) against the 16-byte cdb_t (IOCDBLEN/CAM_MAX_CDBLEN). With at_cdblen=26 and marker CDB bytes 0xE0..0xF9 the verbatim handler left cdb_len=0xf0, tag_action=0xf1, sense_len=0xf2 and init_id=0x0000f9f8 - ten marker bytes written past cdb_io into the following ccb_accept_tio fields exactly as filed. Control (cdblen=16) shows only the legitimate handler-written values. Requires a parallel-SCSI ISP in target mode fed by a hostile initiator (firmware-controlled field). Fix (clamp to sizeof cdb_bytes) A/B: cdb_len=0x10, no marker bytes.

## Evidence (decisive lines)
DF2473[cdblen=26]: IOCDBLEN=16 sizeof(cdb_t)=16 offsets cdb_io=208 cdb_len=224 tag_action=225 sense_len=226 tag_id=228 init_id=232
DF2473: after verbatim handler: cdb_len=0xf0 tag_action=0xf1 sense_len=0xf2 tag_id=0xffffffff init_id=0x0000f9f8
DF2473: marker CDB bytes were 0xE0..0xF9
--- control (cdblen=16) ---
DF2473: after verbatim handler: cdb_len=0x10 tag_action=0x22 sense_len=0x00 tag_id=0xffffffff init_id=0x00000005
--- fixed source A/B ---
DF2473: after verbatim handler: cdb_len=0x10 tag_action=0x22 sense_len=0x00 tag_id=0xffffffff init_id=0x00000005




## Exploit chain / privesc assessment
no unpriv path; target-mode + hostile-initiator configuration; 1..10-byte overflow into adjacent CCB fields (tag_id/init_id bookkeeping confusion per the filing).

## Fix + A/B
fix.diff clamps cdblen to sizeof cdb_bytes (and logs); A/B clean.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.