{
  "finding_id": "DF-3575",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "sym_action() peeks at the first CDB byte with csio->cdb_io.cdb_ptr[0] whenever CAM_CDB_POINTER is set (sym_hipd.c:7526-7528) before any validation; a CCB with cdb_ptr == NULL (deliverable by root via /dev/passN CAMIOCOMMAND, since xpt_merge_ccb copies ccb_h.flags verbatim and cam_periph_mapmem never touches cdb_ptr) NULL-derefs in kernel context and panics. sym_setup_cdbs bcopy (sym_hipd.c:7695) shares the exposure. Privileged-only fixed-offset NULL read: panic/DoS, no corruption primitive -> Low. Not reproduced: the deref lives in the SIM entry path which requires an attached 53C8xx adapter; the guest is virtio-only (sym.ko present, no PCI device to attach), so the path cannot execute there. Source-level certainty is unambiguous.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3575/VERDICT.md (delivery path traced through scsi_pass.c and cam_xpt.c with cites); findings/poc/DF-3575/fix.diff (peek guard + CAM_REQ_INVALID on NULL cdb pointer in sym_setup_cdb); findings/poc/DF-3575/env.txt (guest probe)",
  "kernel_refs": [
    "sys/dev/disk/sym/sym_hipd.c:7526",
    "sys/dev/disk/sym/sym_hipd.c:7695",
    "sys/bus/cam/scsi/scsi_pass.c:279",
    "sys/bus/cam/cam_xpt.c:1818"
  ],
  "poc_changes": "No PoC seed existed. A guest-side trigger is impossible (no sym adapter to attach; sym_action unreachable), so no PoC source was authored \u2014 env probe recorded instead.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 02:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root ls -l /boot/kernel/sym.ko; kldstat -v | grep -w sym; pciconf -l; ls -l /dev/pass0 /dev/xpt0",
  "code_hash": "",
  "notes": "Pass-2 finding, Low severity per rubric (requires already-privileged user; impact is a panic). FreeBSDs historical sym driver shares this code shape.",
  "recommended_fix": "Guard the INQUIRY peek against cdb_ptr == NULL and reject NULL CDB pointers in sym_setup_cdb() with CAM_REQ_INVALID (findings/poc/DF-3575/fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (never applied). Not build-validated: guest has no sym adapter so the patched path cannot be exercised; the change is a two-line NULL guard plus a validation return, no behavioral risk.",
  "fix_evidence": "findings/poc/DF-3575/fix.diff"
}