{
  "finding_id": "DF-2519",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "The verbatim sili_xpt_scsi_disk_io ATA_PASS_16 case contains the duplicated line fis->lba_mid_exp = atp16->lba_mid_ext at sili_cam.c:1219 (byte-identical to :1217); fis->lba_high_exp is never assigned. sili_ata_get_xfer zeroes the FIS (modelled by the rig exactly), so with a CDB carrying distinct extension bytes (lba_high_ext=0xF5) the resulting FIS had lba_mid_exp=0xF4 (correct) but lba_high_exp=0x00 - LBA48 bits 47:40 silently forced to zero and the device targets the wrong sector (data corruption at the disk). Fixed source (assign fis->lba_high_exp = atp16->lba_high_ext) A/B: FIS exp bytes feat=0xf1 cnt=0xf2 low=0xf3 mid=0xf4 high=0xf5 - all five extension bytes delivered.",
  "exploit_chain": "correctness bug reachable by any ATA pass-through user (CAM path); wrong-sector I/O = silent data corruption.",
  "evidence": "run.log: CDB high ext 0xf5 -> FIS high exp 0x00 (BYTE-DROPPED); fixed 0xf5.",
  "kernel_refs": [
    "sys/dev/disk/sili/sili_cam.c:1217",
    "sys/dev/disk/sili/sili_cam.c:1219"
  ],
  "poc_changes": "none - first rig run after the ap_sc NULL fix.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 400,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_sili/gen.sh && make -m /usr/src/share/mk (in dfv_sili)",
  "run_cmd": "kldload dfv_sili.ko; sysctl kern.dfv_sili_run=1; sysctl -n kern.dfv_sili_status",
  "code_hash": "ab004d68394654f1c51a82c0ff6d04eefd08a66d2aa876497d58a28032e03b54",
  "notes": "sili_ata_get_xfer zeroes the FIS (confirmed in the rig), so the unassigned byte is silently 0 and LBA48 bits 47:40 target the wrong sector - data corruption at the device, demonstrated with distinct marker bytes.",
  "recommended_fix": "fix the duplicated line to fis->lba_high_exp = atp16->lba_high_ext",
  "fix_status": "fixed"
}