# DF-2515 verdict -- SCSI CDB copy overflows orb[7] into ind_ptr on 16-byte CDBs

status: reproduced   reproduced: 1   impact: limited_write
confidence: certain   attempts: 1   runtime_sec: 700

The verbatim sbp_action1 copies the CDB with bcopy(cdb, &ocb->orb[5], csio->cdb_len) (sbp.c:2337); the ORB reserves 12 bytes (orb[5..7]) and struct sbp_ocb places ind_ptr immediately after orb[8] (sbp.c:141-152). With a 16-byte CDB (CAM_MAX_CDBLEN; pass(4) allows cdb_len up to 255) the verbatim copy wrote ind_ptr[0].hi = 0xcfcecdcc - CDB bytes 12..15 overwriting the page-table pointer field on the DMA-coherent ocb, visible to the FireWire device. Control (12-byte CDB): canary intact. Fixed source (clamp to 12, log) A/B: 16-byte CDB leaves the canary intact.

## Evidence (decisive lines)
DF2515[cdblen=12]: orb[5]=c0c1c2c3 orb[6]=c4c5c6c7 orb[7]=c8c9cacb
DF2515: ind_ptr[0]=cccccccc/dddddddd ... RESULT=clean
DF2515[cdblen=16]: ind_ptr[0]=cfcecdcc/dddddddd (canary was CCCCCCCC/DDDDDDDD)
DF2515: RESULT=OVERFLOW (cdb_len>12 spills into ind_ptr[0].hi on the DMA-coherent ocb)
--- fixed source A/B ---
DF2515[cdblen=16]: ind_ptr[0]=cccccccc/dddddddd ... RESULT=clean
   (dmesg: "sbp: CDB too long for ORB, clamped")




## Exploit chain / privesc assessment
FireWire-attached hostile initiator (or pass(4) with cdb_len>12): 4+ bytes of device-visible DMA memory corruption inside the ocb; stays within the allocation as filed.

## Fix + A/B
fix.diff clamps the copy to 12 bytes with a log line; A/B canary intact.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.