{
  "finding_id": "DF-2495",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "CONFIRMED at the code level with the OOB write executed by production code twice; impact ceiling on this tree is narrower than filed. The LSI v2 parse takes configs[raid_entry].raid.disk_count (raw u_int8_t) verbatim into rdp->total_disks (ata-raid.c:2856, MAX_DISKS=16). Production ata_raid_status() (ata-raid.c:1013-1025) then runs for (i=0; i<rdp->total_disks; i++) writing status->disks[i].state/lun unconditionally into the generic ioctl layers kmallocd 152-byte copyin buffer (sys/kern/sys_generic.c:664-680: 152 > STK_PARAMS 128 -> kmalloc): with disk_count=255 that is 2064 bytes written -- 1912 bytes past the allocation. Rig test3 proved it deterministically (production parse + production ata_raid_status with guard chunks: 12/24 guards smashed with the production {state=0,lun=-1}=ffffffff00000000 pattern, victim tail overwritten). The real-kernel arm then installed the inflated array into the REAL kernel ata_raid_arrays[0] and the REAL /dev/ata IOCATARAIDSTATUS ioctl (df2495_status, ordinary ioctl(2)) returned 0 with total_disks=255 delivered -- the real kernel executed all 255 iterations and wrote the 1912 OOB bytes into its own heap; no panic across a 3x700 hammer (smashed neighbors were free chunks every time), so impact=none beyond the proven write. Honest downgrade vs the filing: /dev/ata is crw------- root operator (0600, ata-all.c:1025) so the ioctl arms are ROOT-ONLY on this tree (no operator-group reach, no stack smash from CREATE -- its OOB -1 store lands inside the 128-byte stkbuf and the loop stalls on stale-garbage devclass lookups); the unprivileged half of the chain is the crafted-disk metadata inflation itself, whose boot-time writers (ata_raid_config_changed 924-926 OOB bit-clear RMW over disks[16..254]) could not be armed because ANY IDE hard disk hangs SeaBIOS on the standard vm.sh guest (same infrastructural limitation as DF-2494, verified with a benign image). fix.diff (reject disk_count>MAX_DISKS at parse + bound status + validate creates total_disks) validated on a single-fix rebuilt kernel: parse rejects (rc=0), no array installed, ioctl returns ENXIO.",
  "exploit_chain": "crafted LSI v2 superblock with configs[0].raid.disk_count=255 on an ATA disk behind nata -> subdisk attach -> ata_raid_lsiv2_read_meta -> raid->total_disks=255 (ata-raid.c:2856, no bound vs MAX_DISKS=16) -> [boot-time, unprivileged] ata_raid_config_changed (924-926) read-modify-writes disks[16..254] flags (heap OOB bit-clears past the ar_softc) and the attach print loop OOB-reads the same range; [root-gated ioctl half] IOCATARAIDSTATUS lun=0 through /dev/ata (0600 root-only) -> kern_ioctl kmallocs 152 bytes -> production ata_raid_status writes status->disks[0..254] = 2064 bytes = 1912 bytes past the buffer with {0,-1} pairs -> kernel heap corruption of adjacent kmem-pool chunks (silent on this guest; panic potential on denser heaps). CREATE arm: config->total_disks up to INT_MAX loops config->disks[disk] past the 88-byte struct (OOB reads from the 128-byte stkbuf; -1 stores land within stkbuf) -- root-gated, not weaponized.",
  "evidence": "run.log: parse rc=1 ... rdp->total_disks=255 (MAX_DISKS=16, ata-raid.c:2856 takes disk_count verbatim) / writing status->disks[0..254] -> last byte at +2064 (1912 bytes PAST the buffer) / guard chunks hit by the overflow: 12/24 (0xffffffff = lun -1 from production status->disks[i].lun = -1) / real-kernel arm: ioctl returned 0 (errno=0) total_disks=255 with /dev/ata shown crw------- root operator; fix_run.log: parse rc=0 ... cannot run status + ioctl returned -1 (errno=6).",
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:2856",
    "sys/dev/disk/nata/ata-raid.c:1013-1025",
    "sys/dev/disk/nata/ata-raid.c:1051-1151",
    "sys/dev/disk/nata/ata-raid.c:924-926",
    "sys/kern/sys_generic.c:664-680",
    "sys/dev/disk/nata/ata-all.c:1025",
    "sys/sys/nata.h:440-483"
  ],
  "poc_changes": "No pass-1 pack existed (empty dirs); authored fresh: the DF-2494 rig module drives the production parse (disk_count=255, raid_number=0, disk_number=2 to avoid the configs[0] raid/disk union overlay) and calls the production ata_raid_status() with a 152-byte kmallocd victim surrounded by 0xAA guard chunks, replicating the exact kern_ioctl buffer; df2495_status.c is a plain ioctl(2) program for the real /dev/ata arm (pass-1 sketch had wrong struct source -- the real copyin buffer is kernel-side, sys/kern/sys_generic.c:664-680, which is why the smash is kernel heap, not user memory).",
  "attempts": 5,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 3100,
  "guest_dirty": 0,
  "build_cmd": "cd /root/dfrig && make && cc -O2 -Wall -o df2495_status df2495_status.c",
  "run_cmd": "kldload dfrig_ata.ko; sysctl kern.dfrig_ata_test=3; sysctl -n kern.dfrig_ata_status; sysctl kern.dfrig_ata_test=7; /root/dfrig/df2495_status 0",
  "code_hash": "dd86ae7982825f5ff2439adbf9c42fe4724bcdf148476be9b002a4ffbfa2cc1c",
  "notes": "df2495_status.c sha256=88466ba4580ae4c80512846d78dd1428c4d95f8bcc8cfd9dbe2f7ab595490f92. The 3x700-iteration ioctl hammer with concurrent heap churn produced no panic (neighbors free chunks); the write primitive itself is proven by the guarded rig run and by the real ioctl returning total_disks=255. Recommend the orchestrator consider re-triaging severity: defect certain, but on this tree the only unprivileged reach is the crafted-disk metadata half whose visible writers are boot-time; the ioctl arms are root-only (/dev/ata 0600).",
  "recommended_fix": "Reject disk_count > MAX_DISKS in ata_raid_lsiv2_read_meta(); defensively bound rdp->total_disks in ata_raid_status(); reject config->total_disks outside [1,MAX_DISKS] in ata_raid_create().",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Mon Oct 12 11:14:44 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC",
  "fix_verdict": "Single-fix kernel (fix.diff: disk_count>MAX_DISKS rejected at the LSI v2 parse; ata_raid_status bounds rdp->total_disks; ata_raid_create validates config->total_disks) built with nativekernel, installed, rebooted; rig + df2495_status rebuilt on the fixed tree. Baseline behaviors are gone: rig test3s parse now rejects the crafted disk_count=255 (rc=0, parse failed, cannot run status) so the production status OOB write never executes; the real-kernel test7 installs nothing (total_disks=0) and the REAL /dev/ata IOCATARAIDSTATUS returns ENXIO (errno=6) instead of 0-with-1912-OOB-bytes.",
  "fix_evidence": "fix_run.log: parse rc=0: raidp[0]=0 rdp->total_disks=0 ... parse failed, cannot run status and ioctl returned -1 (errno=6) total_disks=0 vs run.log baseline guard chunks hit by the overflow: 12/24 and ioctl returned 0 (errno=0) total_disks=255."
}