# DF-3730 VERDICT

## Finding
After every completed INQUIRY against a logical volume,
`ciss_cam_complete_fixup()` rewrites the inquiry data to advertise the
volume's organisation and status:

```c
    /* sys/dev/raid/ciss/ciss.c:3323-3325 */
    padstr(inq->vendor,  "COMPAQ", 8);                                    /* field is 8  — ok */
    padstr(inq->product, ciss_name_ldrive_org(cl->cl_ldrive->fault_tolerance), 8);   /* field is 16 — ok */
    padstr(inq->revision, ciss_name_ldrive_status(cl->cl_lstatus->status), 16);       /* field is 4! */
```

`padstr` (cissvar.h:374-384) writes **exactly** `len` bytes. The revision
field is `char revision[SID_REVISION_SIZE=4]` at buffer offset 32
(`sys/bus/cam/scsi/scsi_all.h:738-739`), so the third call writes bytes
32..47 — 12 bytes past the end of any inquiry buffer smaller than 48 bytes.
The only size gate on this path is `csio->dxfer_len >= SHORT_INQUIRY_LENGTH`
(36) at ciss.c:3305, so a standard 36-byte INQUIRY data buffer is smashed.

## Reachability
Any CAM client issuing INQUIRY with a 36..44-byte data buffer against an
ONLINE logical volume. In-kernel periphs allocate
`sizeof(struct scsi_inquiry_data)` (≥ 96) and are unaffected; the CAM
pass-through (`/dev/passN`, 0600 root:operator — scsi_pass.c:279-281)
allocates exactly the user-requested `dxfer_len` bytes, so a root/operator
`camcontrol`-style INQUIRY with a 36-byte buffer takes the 12-byte heap
overflow. Content is a NUL-padded fixed-set status string (limited
attacker control: e.g. "failed", "interim recovery", …). FreeBSD's driver
has the identical line (upstream-inherited).

Severity assessment: Low — requires CAM pass-through privileges (root /
operator group), overflow is 12 bytes of semi-fixed string content past a
kmalloc'd buffer.

## Verification (no HP Smart Array on the audit guest)
`harness.c` replicates the three padstr calls at the exact struct offsets
with a canary'd 36-byte buffer:
- baseline (`run.log`, stable in run.2/run.3): `write at buffer+36`,
  buffer[36..47] = 0x20 padding (`"failed    ..."`), `[BUG REPRODUCED]
  12 bytes written past the end`;
- `-DFIXED` (revision padstr bounded to 4): canary intact, `[FIXED]`.

## Fix validation
- `fix.diff`: `padstr(inq->revision, ..., sizeof(inq->revision));`
- `fix_apply.log`: clean dry-run; `fix_build.log`: `ciss.ko` rebuilt with
  all 7 ciss fixes at `-Werror`, link rc=0; `-DFIXED` harness run clean.

**Bottom line: reproduced (harness-level); 12-byte heap overflow, root/operator
-gated; fix validated at compile + replica level.**

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.