{
  "finding_id": "DF-2516",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Honest downgrade after deeper rig work: the rig kernel fault observed during sbp_recv1 dispatch reproduces with a fully ZEROED payload as well, i.e. that crash is a rig fabrication artifact (a NULL in the fabricated firewire graph reached by the verbatim epilogue), NOT the stale-data effect - it is not usable as reproduction evidence. What stands is source-certain and was partially observed: fw_xfer_alloc_buf allocates recv.payload with kmalloc(recv_len, type, M_INTWAIT) and NO M_ZERO (firewire.c:963-964 - recycled heap); sbp_recv1 casts the payload to struct sbp_status (32 bytes) and consumes every field with no delivered-length check (the rig showed the non-zeroed payload retain its 0xA5 tail across the call and the stale-driven SBP_DEBUG prints); sbp_scsi_status then copies stale-derived bytes into ocb->ccb->csio.sense_data, which pass(4) exports to userland - a hostile FireWire device sending a short WREQB discloses stale kernel heap bytes through the sense path. The mechanism is real; the end-to-end mechanical demonstration was not achieved (rig state depth). Fix (M_ZERO at allocation) compile-validated in the firewire module build.",
  "exploit_chain": "hostile FireWire device -> stale kernel heap bytes drive control flow and reach the CCB sense buffer toward userland; ceiling: limited info leak.",
  "evidence": "source chain + partial rig observations (stale tail retained; stale-driven debug path taken); no mechanical end-to-end capture.",
  "kernel_refs": [
    "sys/dev/disk/sbp/sbp.c:1572",
    "sys/bus/firewire/firewire.c:963",
    "sys/bus/firewire/firewire.c:964",
    "sys/dev/disk/sbp/sbp.c:1707"
  ],
  "poc_changes": "the crash artifact is documented rather than claimed; sbp struct-extraction required several rounds (unbalanced #if 0 in a line-range extract; col-0 inner braces defeating naive brace matching).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_sbp/gen.sh && make -m /usr/src/share/mk (in dfv_sbp)",
  "run_cmd": "kldload dfv_sbp.ko; sysctl kern.dfv_sbp_run=2",
  "code_hash": "4ad22e845f12bf39854f85039a7eef5732a46bf38c8ae507c1059c2a634b2b92",
  "notes": "DOWNGRADED after deeper rig work: the rig kernel fault during sbp_recv1 reproduces with a fully ZEROED payload too, i.e. the crash is a rig fabrication artifact (NULL in the fake firewire graph), not the stale-data effect. The source chain is intact and certain: firewire.c:963 kmalloc(recv_len, M_INTWAIT) without M_ZERO, sbp_recv1 casting the payload to struct sbp_status with no delivered-length check, sbp_scsi_status copying stale-derived bytes into csio->sense_data (pass(4) exports sense to userland). Fix (M_ZERO at allocation) compile-validated in the firewire module build.",
  "recommended_fix": "allocate fw_xfer recv payloads with M_ZERO",
  "fix_status": "compile_validated"
}