{
  "finding_id": "DF-2530",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "limited_write",
  "confidence": "certain",
  "verdict": "vpo_intr hands csio->sense_len (user CCB byte, 0..255 via pass(4) xpt_merge_ccb) and &csio->sense_data (32 bytes) to the transfer engine; the verbatim imm_do_scsi wrote 255 bytes (count=255) into the 32-byte field - the rig dump shows sense bytes 28..39 all 0x5A and the post-CCB markers destroyed: cdb_len=0x5a sglist_cnt=0x5a5a scsi_status=0x5a sense_resid=0x5a resid=0x5a5a5a5a (pre-set markers 11/22/33/44/55) - 223 bytes past the field into the rest of union ccb, exactly the field list in the finding. Control (sense_len=32) leaves the markers intact. This is the same unclamped-length class as DF-2522 (trm), which this project already reproduced with the production handler. Fixed-caller model (vpo.c clamps to sizeof sense_data before the call) A/B: 32 bytes written, markers intact.",
  "exploit_chain": "local privileged (root/operator via pass(4) on the vpo bus, plus physical parallel-port device); bounded CCB corruption, not arbitrary write.",
  "evidence": "run.log: 255 bytes written, markers destroyed; control 32/intact; fixed-caller model intact.",
  "kernel_refs": [
    "sys/dev/disk/vpo/vpo.c:266",
    "sys/dev/disk/vpo/vpo.c:272",
    "sys/dev/disk/vpo/vpo.c:279",
    "sys/bus/cam/cam_ccb.h:553"
  ],
  "poc_changes": "same transport rig as DF-2529; fixed-caller A/B models the clamped call the patched vpo.c makes.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 700,
  "guest_dirty": 0,
  "build_cmd": "sh /root/rigs/dfv_vpo/gen.sh && make -m /usr/src/share/mk (in dfv_vpo)",
  "run_cmd": "kldload dfv_vpo.ko; sysctl kern.dfv_vpo_run=1; sysctl -n kern.dfv_vpo_status",
  "code_hash": "ed340dabe20ecab1e561e2708ec2116b2ebdef1ac6cb4b4f99bb08184f4d9c74",
  "notes": "sense_len=255 writes 255 bytes into the 32-byte sense_data and destroys cdb_len/sglist_cnt/scsi_status/sense_resid/resid markers (223 bytes past the field) inside union ccb. Bounded CCB corruption, not arbitrary write. Fixed-caller model (clamped to 32) clean. Same class as DF-2522 (trm) which was reproduced with the production handler.",
  "recommended_fix": "clamp the REQUEST_SENSE length to sizeof sense_data",
  "fix_status": "fixed"
}