{
  "finding_id": "DF-2508",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "The verbatim afd_sense capabilities-page path (atapi-fd.c:405-409) computes mediasize = be16toh(cylinders) * heads * sectors * sectorsize in 32-bit int arithmetic before the u_int64_t assignment (the sibling capacity paths at :384/:393 cast to u64 first). With drive-supplied geometry cyl=65535 heads=255 sectors=63 ss=512 the verbatim function computed mediasize=2172812800 (0x81827e00) where correct u64 math gives 539043724800 (0x7d81827e00) - exactly the low 32 bits; the second hostile geometry truncated 0x1fc0003fe00 -> 0x3fe00. The bogus size is published to the disk layer (partitioning/geometry corruption). Control geometry exact. Fixed source (u64 cast first) A/B: mediasize = 0x7d81827e00 exactly.",
  "exploit_chain": "logic/correctness (no memory safety): wrong media size from malicious/buggy ATAPI mode-sense data; corruption of on-disk assumptions.",
  "evidence": "run.log: expected 0x7d81827e00 vs verbatim 0x81827e00 (exact low-32 truncation); fixed exact.",
  "kernel_refs": [
    "sys/dev/disk/nata/atapi-fd.c:405",
    "sys/dev/disk/nata/atapi-fd.c:409",
    "sys/dev/disk/nata/atapi-fd.c:384",
    "sys/dev/disk/nata/atapi-fd.c:393"
  ],
  "poc_changes": "ata_atapicmd interposed to serve hostile mode-sense data (forces the capabilities path by failing both capacity commands).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 500,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_afd/gen.sh && make -m /usr/src/share/mk (in dfv_afd)",
  "run_cmd": "kldload dfv_afd.ko; for i in 0 1 2; do sysctl kern.dfv_afd_run=$i >/dev/null; sysctl -n kern.dfv_afd_status; done",
  "code_hash": "b4b4286c8923a813d97cd16b731f04ce917000d91fbebe6d2e51f14ab94fbcd4",
  "notes": "Logic/correctness bug (bogus media size), not memory safety; u64-math fix verified to the byte (0x7d81827e00).",
  "recommended_fix": "cast the capabilities product to u64 before multiplying",
  "fix_status": "fixed"
}