{
  "finding_id": "DF-2515",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "limited_write",
  "confidence": "certain",
  "verdict": "The verbatim sbp_action1 copies the CDB with bcopy(cdb, &ocb->orb[5], csio->cdb_len) (sbp.c:2337); the ORB reserves 12 bytes (orb[5..7]) and struct sbp_ocb places ind_ptr immediately after orb[8] (sbp.c:141-152). With a 16-byte CDB (CAM_MAX_CDBLEN; pass(4) allows cdb_len up to 255) the verbatim copy wrote ind_ptr[0].hi = 0xcfcecdcc - CDB bytes 12..15 overwriting the page-table pointer field on the DMA-coherent ocb, visible to the FireWire device. Control (12-byte CDB): canary intact. Fixed source (clamp to 12, log) A/B: 16-byte CDB leaves the canary intact.",
  "exploit_chain": "FireWire-attached hostile initiator (or pass(4) with cdb_len>12): 4+ bytes of device-visible DMA memory corruption inside the ocb; stays within the allocation as filed.",
  "evidence": "run.log: ind_ptr[0]=cfcecdcc/dddddddd with 16B CDB (canary cccccccc/dddddddd); control clean; fixed clean.",
  "kernel_refs": [
    "sys/dev/disk/sbp/sbp.c:2337",
    "sys/dev/disk/sbp/sbp.c:144",
    "sys/dev/disk/sbp/sbp.c:148",
    "sys/dev/disk/sbp/sbp.c:72"
  ],
  "poc_changes": "struct/define block extracted verbatim (sbp.c:63-292); transport interposed.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 700,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_sbp/gen.sh && make -m /usr/src/share/mk (in dfv_sbp)",
  "run_cmd": "kldload dfv_sbp.ko; sysctl kern.dfv_sbp_run=0; sysctl -n kern.dfv_sbp_status; sysctl kern.dfv_sbp_run=1; sysctl -n kern.dfv_sbp_status",
  "code_hash": "4ad22e845f12bf39854f85039a7eef5732a46bf38c8ae507c1059c2a634b2b92",
  "notes": "Overflow stays inside the ocb allocation (ind_ptr[0].hi) - device-visible DMA memory corruption, not kernel-pointer corruption. 12-byte control clean.",
  "recommended_fix": "clamp the CDB copy into orb[5..7] to 12 bytes",
  "fix_status": "fixed"
}