{
  "finding_id": "DF-2502",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "The verbatim atapi_action assigns int len = csio->dxfer_len (u_int32) at :565; the INQUIRY special case then calls bzero(buf, len) with an INQUIRY CDB whose length field exceeds SHORT_INQUIRY_LENGTH. With a pass(4)-shaped CCB (dxfer_len=0x80000000, INQUIRY cdb byte4=255) the verbatim code issued bzero(buf, 18446744071562067968) - the sign-extended INT_MIN length captured live from the verbatim call (the rig intercepts the actual memset; in production this is an unbounded kernel-memory zeroing starting at the CDB data buffer). Control (dxfer_len=512) issued bzero(512) exactly. Both runs continue past the INQUIRY case into a rig-fabrication-depth crash at 0x64(%rcx) (present in control and hostile alike - documented as a rig artifact; the bzero length is the discriminator). Fixed source A/B (reject dxfer_len > 0x7fffffff before the special cases): NO bzero is issued at all and the guest survives the run cleanly. The first fix draft used (u_int)len != dxfer_len, which the round-trip makes always-false - caught by the A/B rerun and corrected.",
  "exploit_chain": "catastrophic kernel memory wipe from a CCB the CAM pass path can carry; on this system the raw-device permission gate bounds who can build it; impact class: corruption.",
  "evidence": "run.log: DF2502 bzero(len=18446744071562067968) hostile vs bzero(len=512) control; fixed: zero bzero calls.",
  "kernel_refs": [
    "sys/dev/disk/nata/atapi-cam.c:565",
    "sys/dev/disk/nata/atapi-cam.c:569",
    "sys/dev/disk/nata/atapi-cam.c:578",
    "sys/dev/disk/nata/atapi-cam.c:509"
  ],
  "poc_changes": "bzero interposed (rig) to capture the length; the first fix draft was refuted by A/B and corrected to the > INT_MAX form.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_acam/gen.sh && make -m /usr/src/share/mk (in dfv_acam)",
  "run_cmd": "kldload dfv_acam.ko; sysctl kern.dfv_acam_run=0 (control); reset; sysctl kern.dfv_acam_run=2 (hostile)",
  "code_hash": "574a1963de07f33d6b6b80d55a48e25eefae91391e5c8f5e8a925e6470e15f24",
  "notes": "pass(4) gives an unprivileged-capable path only where pass devices are permissioned; on this guest the raw-disk RESTRICTEDROOT gate applies to disk nodes (DF-2504 evidence). The bzero length (0xffffffff80000000) captured live; rig intercepts the actual memset (production would wipe kernel memory). The post-INQUIRY rig crash at 0x64(%rcx) is a rig fabrication-depth artifact, identical in control and hostile runs; the bzero length is the discriminator.",
  "recommended_fix": "reject dxfer_len > INT_MAX before assigning to int len",
  "fix_status": "fixed"
}