# DF-2520 — trm_ExecuteSRB writes user-controlled nseg SG entries into 32-slot pSRBSGL

## Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

## Hardware gate

No Tekram DC395 SCSI HBA in guest: `kldstat` shows only kernel/ehci/xhci; `pciconf -l`
shows no Tekram PCI device. The trm driver does not attach.

## Source trace (confirmed real bug)

**File:** `sys/dev/disk/trm/trm.c:433-440` (trm_ExecuteSRB)

```c
psg = pSRB->pSRBSGL;           // DMA-coherent region: TRM_MAX_SG_LISTENTRY(32) * sizeof(SGentry)
while (dm_segs < end_seg) {
    psg->address = dm_segs->ds_addr;
    psg->length = (u_long)dm_segs->ds_len;
    psg++;
    dm_segs++;
}
```

`pSRBSGL` is allocated as `TRM_MAX_SG_LISTENTRY * sizeof(SGentry)` = 32 * 8 = 256
bytes (trm.h:92, 3498). The DMA tag `buffer_dmat` allows `TRM_NSEG` segments
(`btoc(MAXPHYS)+1`, typically 33). If `nseg > 32`, the loop writes past the 32-entry
SG list into adjacent SRB SG lists / kernel heap. There is **no bounds check** on
`nseg` before the loop.

## Fix

Added `if (nseg > TRM_MAX_SG_LISTENTRY)` early-return check before the SG fill loop.
See `fix.diff`.

## Impact (on HW that has the HBA)

High — heap overflow via pass(4) SCATTER_VALID with `sglist_cnt > 32`. Operator-group
`/dev/passN` access suffices.