{
  "finding_id": "DF-3582",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Type-confusion confirmed at source level with arithmetic proven on the guest against the real kernel headers: isp_parse_status() RQCS_RESET_OCCURRED (sys/dev/disk/isp/isp.c:6110) writes FCPARAM(isp, chan)->sendmarker on cards whose isp_param is a sdparam array (isp_pci.c:827-832); on dual-bus SCSI cards (nchan=2) the chan=1 iteration is a 32-bit read-modify-write at isp_param+21576, i.e. 21,168 bytes past the 408-byte kmalloc. The extracted-logic PoC faults at exactly +21576 (run.log). Guest has no QLogic HBA (pciconf empty, /dev/isp* absent) so the in-kernel path could not be triggered end-to-end; driver is compiled into GENERIC (kldstat -v: pci/isp) and dual-bus firmware modules ship in /boot/kernel, so the path is live on real hardware. Modern FreeBSD removed this legacy parse path entirely; the bug comes from the 2011 FreeBSD revision DragonFly carries.",
  "exploit_chain": "",
  "evidence": "run.log (full guest session: build, 2 runs, env) \u2014 decisive lines chan=1: FAULT (SIGSEGV/SEGV) ... offset 21576 ... 21168 past end of 408-byte alloc; trigger_df3582.c (includes real dev/disk/isp/ispvar.h etc.); VERDICT.md; fix.diff (one-line fix via existing ISP_SET_SENDMARKER macro, ispvar.h:646)",
  "kernel_refs": [
    "sys/dev/disk/isp/isp.c:6105-6111",
    "sys/dev/disk/isp/isp.c:5280",
    "sys/dev/disk/isp/ispvar.h:643-652",
    "sys/dev/disk/isp/isp_pci.c:732",
    "sys/dev/disk/isp/isp_pci.c:749",
    "sys/dev/disk/isp/isp_pci.c:824-832",
    "sys/dev/disk/isp/ispmbox.h:728"
  ],
  "poc_changes": "No seed existed (pass-2 new finding). Wrote trigger from scratch; it #includes the verbatim kernel headers copied from the guests /usr/src so struct sizes/offsets are the audited kernels, and places the 408-byte allocation stand-in against a PROT_NONE reserve so the wild write faults deterministically. First variant used an 8KB mapping and the write silently landed in an adjacent mapping (itself an accurate demo of silent heap corruption); restructured to a 1MB PROT_NONE reserve with a single RW page for a deterministic fault.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -I. -o trigger_df3582 trigger_df3582.c  (headers copied from /usr/src/sys/dev/disk/isp)",
  "run_cmd": "./trigger_df3582",
  "code_hash": "58382c632d99e86d807c0098303052c136c8287d68c7e2de2e4cbd68af49e0e2",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff replaces the raw FCPARAM write with the drivers own ISP_SET_SENDMARKER(isp, chan, 1) macro which selects FCPARAM/SDPARAM by IS_FC() \u2014 type-correct on both card families and consistent with every other sendmarker write in the file (e.g. isp.c:6120). Baseline could not be reproduced on this guest (no QLogic HBA), so a patched-kernel A/B run was impossible; the fix is a mechanical type-correctness correction with no behavioral change on FC cards.",
  "fix_evidence": "fix.diff (git-apply-able against sys/dev/disk/isp/isp.c hunk at line 6110)",
  "notes": "Pass-2 finding; adjacent to pass-1 DF-2469 (RQCS_SYNCXFER_FAILED, isp.c:6279-6287) which double-offsets SDPARAM \u2014 same file, different defect: this one is a full struct-type confusion with a ~21KB displacement. chan=0 iteration lands in sdparams unnamed pad bits (benign); only the chan=1 iteration on dual-bus cards is the OOB write. Trigger is a routine event (SCSI bus reset destroying an in-flight command), not an exotic status.",
  "recommended_fix": "Replace FCPARAM(isp, chan)->sendmarker = 1 with ISP_SET_SENDMARKER(isp, chan, 1) in isp_parse_status()s RQCS_RESET_OCCURRED handler."
}