{
  "finding_id": "DF-2497",
  "title": "Unbounded disk-index loop in SPAN/JBOD I/O strategy causes OOB read / hang",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "guest /root/dfrig3: ./build.sh (production ata-raid.c #included into dfrig3_ata.ko)",
    "run": "kldload ./dfrig3_ata.ko; sysctl kern.dfrig3_ata_test=11; sysctl -n kern.dfrig3_ata_status; sysctl kern.dfrig3_ata_test=13; sysctl -n kern.dfrig3_ata_status",
    "expected": "test11: production HPTv2 SPAN parse (total_disks=2, 1000 usable sectors) + production ata_raid_strategy blkno=5000 -> STRATEGY DISPATCH with this(drv)=30 (>= MAX_DISKS=16, 29 past total_disks) using the OOB-read disks[30].dev. test13: walk reaches drv=51, disks[51] read 168 bytes PAST the 2424-byte allocation (natural heap stop; dispatch with OOB dev)."
  },
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:348-355",
    "sys/dev/disk/nata/ata-raid.c:397-411",
    "sys/dev/disk/nata/ata-raid.c:1844-1894",
    "sys/dev/disk/nata/ata-raid.h:97-110"
  ],
  "fix": "fix.diff: bound the walk (drv < (int)rdp->total_disks) and biofinish(bp, NULL, EIO) for block numbers past the array end",
  "artifacts": [
    "README.md", "VERDICT.md", "dfrig3_ata.c", "Makefile", "atastat.c",
    "build.sh", "run.sh", "run_nonfatal.log", "run_test13.log", "env.txt",
    "fix.diff", "fix_build.log", "fix_validation.log", "manifest.json", "verdict.json"
  ]
}