{
  "finding_id": "DF-2494",
  "title": "BSS out-of-bounds write on global ata_raid_arrays[] via untrusted LSI v2 raid_number",
  "verdict": "reproduced",
  "impact": "none_demonstrated_silent_corruption",
  "reproduce": {
    "build": "guest /root/dfrig: ./build.sh (compiles production sys/dev/disk/nata/ata-raid.c into dfrig_ata.ko via #include)",
    "run": "kldload /root/dfrig/dfrig_ata.ko; sysctl kern.dfrig_ata_test=1 (or 2/4/5/6); sysctl -n kern.dfrig_ata_status",
    "expected": "test1: production parse stores an ar_softc heap pointer at raidp[0+29], 104 bytes past the 16-entry array (rc=1, before/after witness diff). test2: first OOB slot (+128 = &atapi_cam_devclass in the real kernel) written and retained. test6: same parse against the REAL kernel ata_raid_arrays (0xffffffff8114dec0): skip-occupied walk corrupts real kernel BSS / type-confuses a live heap object."
  },
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:2799-2806",
    "sys/dev/disk/nata/ata-raid.c:2816",
    "sys/dev/disk/nata/ata-raid.c:2819-2822",
    "sys/dev/disk/nata/ata-raid.c:2866-2876",
    "sys/dev/disk/nata/ata-raid.h:456-513",
    "sys/dev/disk/nata/ata-raid.c:138"
  ],
  "fix": "fix.diff: reject meta->raid_number >= MAX_ARRAYS or meta->disk_number >= MAX_DISKS right after the $XIDE$ magic check (also bounds configs[raid_number] and, with the companion disk_count check from DF-2495, disks[])",
  "artifacts": [
    "README.md", "VERDICT.md", "dfrig_ata.c", "Makefile", "craft_meta.py",
    "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "env.txt",
    "fix.diff", "fix_build.log", "fix_run.log", "fix_tests_123.log", "fix_tests_67.log",
    "manifest.json", "verdict.json"
  ]
}