# DF-2513 verdict -- Unvalidated device-controlled shift in nvme namespace block-size

status: reproduced   reproduced: 1   impact: corruption
confidence: certain   attempts: 2   runtime_sec: 500

The verbatim nvme_admin_state_identify_ns computes nsc->blksize = 1 << lbafmt->sect_size (nvme_admin.c:673-675) with sect_size a device-controlled uint8_t from the Identify Namespace DMA and no range check. The rig refills the crafted Identify response at the DMA-completion boundary (after the drivers bzero of req->info - the first version filled too early and the bzero wiped it). Results: sect_size=9 -> 512 (legal control); 31 -> 0x80000000 (2GiB blocks); 36 -> 16 (shift count masked to 5 bits - C11 UB); 63 -> 0x80000000. The garbage blksize is what nvme_disk_attach publishes as the namespace media block size (geometry/media-size corruption; divisor in I/O sizing). Fixed source (reject formats outside 9..12, skip attach) A/B: attach count 0, no garbage published.

## Evidence (decisive lines)
DF2513[sect_size=9]:  nvme_disk_attach saw blksize=512
DF2513[sect_size=31]: nvme_disk_attach saw blksize=2147483648
DF2513[sect_size=36]: nvme_disk_attach saw blksize=16
DF2513[sect_size=63]: nvme_disk_attach saw blksize=2147483648
--- fixed source A/B ---
DF2513[sect_size=31]: nvme_disk_attach saw blksize=3735928559 (attach count 0)  <- attach skipped, nothing published




## Exploit chain / privesc assessment
hostile/faulty NVMe controller (PCI trust); geometry corruption; no memory-safety violation by itself.

## Fix + A/B
fix.diff rejects sect_size outside 9..12 and skips the attach; A/B shows no namespace published.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.