# DF-2508 verdict -- u32 overflow in afd_sense capabilities-path mediasize computation

status: reproduced   reproduced: 1   impact: corruption
confidence: certain   attempts: 1   runtime_sec: 500

The verbatim afd_sense capabilities-page path (atapi-fd.c:405-409) computes mediasize = be16toh(cylinders) * heads * sectors * sectorsize in 32-bit int arithmetic before the u_int64_t assignment (the sibling capacity paths at :384/:393 cast to u64 first). With drive-supplied geometry cyl=65535 heads=255 sectors=63 ss=512 the verbatim function computed mediasize=2172812800 (0x81827e00) where correct u64 math gives 539043724800 (0x7d81827e00) - exactly the low 32 bits; the second hostile geometry truncated 0x1fc0003fe00 -> 0x3fe00. The bogus size is published to the disk layer (partitioning/geometry corruption). Control geometry exact. Fixed source (u64 cast first) A/B: mediasize = 0x7d81827e00 exactly.

## Evidence (decisive lines)
DF2508[1]: geometry cyl=65535 heads=255 sectors=63 ss=512
DF2508: expected mediasize (u64 math) = 539043724800 (0x7d81827e00)
DF2508: verbatim afd_sense computed mediasize = 2172812800 (0x81827e00)
DF2508: RESULT=WRAPPED (product evaluated in 32-bit int before the u64 assignment)
DF2508[2]: expected 0x1fc0003fe00 -> verbatim 0x3fe00
--- control ---
DF2508[0]: 1073741824 == 1073741824 clean
--- fixed source A/B ---
DF2508: verbatim afd_sense computed mediasize = 539043724800 (0x7d81827e00) ... RESULT=clean




## Exploit chain / privesc assessment
logic/correctness (no memory safety): wrong media size from malicious/buggy ATAPI mode-sense data; corruption of on-disk assumptions.

## Fix + A/B
fix.diff casts the first operand to u_int64_t before the product; A/B exact.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.