{
  "finding_id": "DF-2473",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "limited_write",
  "confidence": "certain",
  "verdict": "Compiled with ISP_TARGET_MODE (the only configuration in which this code exists - no in-tree build defines it), the verbatim isp_handle_platform_atio runs ISP_MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, aep->at_cdblen) with at_cdblen a firmware uint8_t (ATIO_CDBLEN = 26) against the 16-byte cdb_t (IOCDBLEN/CAM_MAX_CDBLEN). With at_cdblen=26 and marker CDB bytes 0xE0..0xF9 the verbatim handler left cdb_len=0xf0, tag_action=0xf1, sense_len=0xf2 and init_id=0x0000f9f8 - ten marker bytes written past cdb_io into the following ccb_accept_tio fields exactly as filed. Control (cdblen=16) shows only the legitimate handler-written values. Requires a parallel-SCSI ISP in target mode fed by a hostile initiator (firmware-controlled field). Fix (clamp to sizeof cdb_bytes) A/B: cdb_len=0x10, no marker bytes.",
  "exploit_chain": "no unpriv path; target-mode + hostile-initiator configuration; 1..10-byte overflow into adjacent CCB fields (tag_id/init_id bookkeeping confusion per the filing).",
  "evidence": "run.log: marker bytes 0xF0-0xF9 in cdb_len/tag_action/sense_len/init_id after the verbatim handler; control clean; fixed clean.",
  "kernel_refs": [
    "sys/dev/disk/isp/isp_freebsd.c:1926",
    "sys/dev/disk/isp/isp_freebsd.c:1927",
    "sys/dev/disk/isp/ispmbox.h:1965",
    "sys/dev/disk/isp/ispmbox.h:1980",
    "sys/bus/cam/cam_ccb.h:584"
  ],
  "poc_changes": "rig compiled with -DISP_TARGET_MODE; platform functions interposed.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 600,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_ispt/gen.sh && make -m /usr/src/share/mk (in dfv_ispt)",
  "run_cmd": "kldload dfv_ispt.ko; sysctl kern.dfv_ispt_run=1; sysctl -n kern.dfv_ispt_status",
  "code_hash": "17f30f813d452e4f0168d478cf5258df01d7326d7f29e5ea16f5567f9c6e3b04",
  "notes": "ISP_TARGET_MODE-compiled rig (the only way this path exists). Control (cdblen=16) shows the handler legitimately rewrites cdb_len/tag_id/init_id; hostile (26) shows marker CDB bytes 0xF0..0xF9 in those fields - spill proven by marker origin.",
  "recommended_fix": "clamp aep->at_cdblen to sizeof cdb_bytes before ISP_MEMCPY",
  "fix_status": "fixed"
}