# DF-3692 VERDICT

**Status: reproduced** (panic in the ioctl dispatcher; arbitrary-index OOB
read of a kernel pointer table).

## Reproduction
Guest: DragonFly 6.5-DEVELOPMENT X86_64_GENERIC (ataraid compiled in, so
`ata_raid_ioctl_func` is live without kldload). `/dev/ata` is 0600
root:operator → run as root.

```
/tmp/poc/f3_ioctl_lun status 0          -> "status ioctl: Device not configured" (ENXIO, in-bounds)
/tmp/poc/f3_ioctl_lun rebuild 134217728 -> (no reply; ssh dies)
```
Serial console:
```
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffffffffc114dec0
fault code = supervisor read data, page not present
current process = 5424
Stopped at ata_raid_ioctl+0x154: movq ata_raid_arrays(,%rax,8),%rcx
```
`0xffffffffc114dec0 - 8*0x8000000 = 0xffffffff8114dec0 = &ata_raid_arrays[0]`
— the fault is the OOB table read itself (the dispatch was inlined into
`ata_raid_ioctl`). Guest wedged in DDB.

## Primitive characterization
- Demonstrated: controlled-index OOB read of kernel .bss → fatal fault
  (panic / persistent DoS of the management path).
- Same primitive with adjacent (mapped) indexes yields a *content-derived*
  `struct ar_softc *` that STATUS copies fields out of to userspace
  (two-level kernel-memory disclosure), REBUILD writes through
  (`status |= 0x4`, `rebuild_lba = 0`), and DELETE kfrees — arbitrary free.
  These variants are source-certain but were not individually exercised
  (they depend on what pointer value happens to sit at the chosen slot; on
  this no-KASLR guest `ata_raid_arrays` is at 0xffffffff8114dec0 and slots
  16+ are other kernel data). Root-gated (see README), hence Medium.

## Fix validation
fix.diff adds `< 0 || >= MAX_ARRAYS` guards for the lun/array index in all
four subcommands (STATUS/DELETE/ADDSPARE/REBUILD). Patched kernel:
`rebuild 134217728` → `rebuild ioctl: Invalid argument`, guest stays up
(`run.patched.log`). fix_status = fixed.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.