{
  "finding_id": "DF-3805",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "mprsas_action_scsiio copies csio->cdb_len bytes (u8, up to 255) into the 32-byte req->CDB.CDB32 field (mpr_sas.c:2102-2109; CDB32 at mpi2_init.h:124, offset 0x40) with no bound when CAM_CDB_POINTER is set and only an INVARIANTS-only KASSERT otherwise (sys/sys/systm.h:94-118). Guest run PROVED the framework-level precondition: a cdb_len=255 CAM_CDB_POINTER CCB submitted via CAMIOCOMMAND passes passioctl/xpt_merge_ccb untouched and reaches the SIM (status 0x6 = CAM_CCB_LEN_ERR came from the ahci SIMs own 6..16 check, ahci_cam.c:1512; run.log). The mpr manifestation (overflow of the request frame in the req_frames DMA pool, mpr.c:1530, incl. past the allocation for the last SMID; also a kernel read of a raw user cdb_ptr since cam_periph_mapmem never maps it) could not be exercised because the guest has no SAS3 HBA and the mpr SIM never attaches (env.txt). Root-gated (/dev/pass*), capping severity at Low.",
  "exploit_chain": "root user issues CAMIOCOMMAND with cdb_len>32 -> bcopy overflows request frame in req_frames DMA pool with attacker bytes; on the last SMID writes past the DMA allocation",
  "evidence": "cdb_overlong.c, build.log (BUILD_OK), run.log (status 0x6 = CAM_CCB_LEN_ERR from ahci SIM; framework imposed no bound), env.txt, VERDICT.md, fix.diff",
  "kernel_refs": [
    "sys/dev/raid/mpr/mpr_sas.c:2102",
    "sys/dev/raid/mpr/mpr_sas.c:2108",
    "sys/dev/raid/mpr/mpi/mpi2_init.h:124",
    "sys/dev/raid/mpr/mpr.c:1530",
    "sys/bus/cam/cam_ccb.h:603",
    "sys/dev/disk/ahci/ahci_cam.c:1512"
  ],
  "poc_changes": "Added the includes DF needs (bus/cam/scsi/scsi_message.h for MSG_SIMPLE_Q_TAG, bus/cam/scsi/scsi_pass.h for CAMIOCOMMAND); DF libcam is a stub so the probe uses the raw CAMIOCOMMAND ioctl on /dev/pass0.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o /tmp/cdb_overlong /root/cdb_overlong.c",
  "run_cmd": "/tmp/cdb_overlong /dev/pass0",
  "code_hash": "232f586e6a3c298be8c1e0ffd64d1fad31f8ace5989326f33c331fbc51020488",
  "notes": "Same class as DF-2422 (ahci). Upstream FreeBSD mpr(4) shares the missing bound.",
  "recommended_fix": "Reject cdb_len outside 6..32 with CAM_CCB_LEN_ERR before the bcopy in mprsas_action_scsiio.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the range check; the mpr SIM cannot be reached on this guest, so no kernel build/validation was performed.",
  "fix_evidence": "findings/poc/DF-3805/fix.diff"
}