{
  "finding_id": "DF-2501",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "The verbatim atapi_action XPT_RESET_DEV case (atapi-cam.c:428-432) evaluates softc->atadev[tid]->dev with neither the NULL guard XPT_PATH_INQ applies at :385 nor the guard XPT_SCSI_IO applies at :490. Dispatching XPT_RESET_DEV with atadev[0] == NULL (the state reinit_bus leaves behind) panicked the kernel at the exact deref: Fatal trap 12, fault VA 0x0, stopped at the movq through the NULL atadev - the precise instruction the finding cites. Fixed source A/B: the same dispatch returns CAM_DEV_NOT_THERE (xpt_done status=0x8 logged) and the guest survives. Trigger model per the filing: CAM dispatch racing atacontrol reinit/hot-plug - privileged/physical context; the pass(4) route to XPT_RESET_DEV is also gated by raw-device permissions on this system.",
  "exploit_chain": "deterministic kernel NULL-deref panic; privesc ceiling: none (DoS).",
  "evidence": "panic.txt: Fatal trap 12 at dfv_acam_sysctl (inlined verbatim atapi_action XPT_RESET_DEV), fault VA 0x0; fixed: xpt_done(status=0x8) CAM_DEV_NOT_THERE.",
  "kernel_refs": [
    "sys/dev/disk/nata/atapi-cam.c:428",
    "sys/dev/disk/nata/atapi-cam.c:432",
    "sys/dev/disk/nata/atapi-cam.c:385",
    "sys/dev/disk/nata/atapi-cam.c:490"
  ],
  "poc_changes": "verbatim atapi_action + struct extraction; ATA transport interposed; get_mplock stubs (not exported to KLDs on this kernel).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 700,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_acam/gen.sh && make -m /usr/src/share/mk (in dfv_acam)",
  "run_cmd": "kldload dfv_acam.ko; sysctl kern.dfv_acam_run=1   # panics the stock kernel",
  "code_hash": "574a1963de07f33d6b6b80d55a48e25eefae91391e5c8f5e8a925e6470e15f24",
  "notes": "Trigger model per finding: atadev[tid] NULLed by reinit_bus while the CAM path lives (atacontrol reset / hot-plug race) - privileged or physical-context. Panic captured at the verbatim deref; fixed guard returns CAM_DEV_NOT_THERE.",
  "recommended_fix": "NULL/bounds guard atadev[tid] in XPT_RESET_DEV like XPT_SCSI_IO",
  "fix_status": "fixed"
}