{
  "finding_id": "DF-2495",
  "title": "Kernel heap OOB write via untrusted total_disks (LSI v2 disk_count -> ata_raid_status / ata_raid_create)",
  "verdict": "reproduced",
  "impact": "none_demonstrated_silent_corruption",
  "reproduce": {
    "build": "guest /root/dfrig: ./build.sh (dfrig_ata.ko, production ata-raid.c compiled in) + cc -O2 -o df2495_status df2495_status.c",
    "run": "kldload dfrig_ata.ko; sysctl kern.dfrig_ata_test=3 (rig proof: production parse + production ata_raid_status 1912 bytes past the 152-byte ioctl buffer, 12/24 guards smashed); then the real-kernel arm: sysctl kern.dfrig_ata_test=7 && ./df2495_status 0 (REAL /dev/ata ioctl returns total_disks=255 = all 255 iterations executed in the real kernel)",
    "expected": "run.log: guard words ffffffff00000000 written past the victim; baseline ioctl returns 0 with total_disks=255 (1912 OOB bytes); on the fixed kernel the parse is rejected and the ioctl returns ENXIO."
  },
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:2856",
    "sys/dev/disk/nata/ata-raid.c:1013-1025",
    "sys/dev/disk/nata/ata-raid.c:1051-1151",
    "sys/dev/disk/nata/ata-raid.c:924-926",
    "sys/kern/sys_generic.c:664-680",
    "sys/dev/disk/nata/ata-all.c:1025",
    "sys/sys/nata.h:440-483"
  ],
  "fix": "fix.diff: reject disk_count > MAX_DISKS at the LSI v2 parse; bound rdp->total_disks in ata_raid_status(); reject config->total_disks outside [1,MAX_DISKS] in ata_raid_create()",
  "artifacts": [
    "README.md", "VERDICT.md", "dfrig_ata.c", "df2495_status.c", "Makefile",
    "build.sh", "run.sh", "build.log", "run.log", "env.txt",
    "fix.diff", "fix_build.log", "fix_run.log", "fix_tests_123.log", "fix_tests_67.log",
    "manifest.json", "verdict.json"
  ]
}