{
  "finding_id": "DF-3920",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Kernel stack overflow is certain at source level: csio.cdb_len (u_int8_t, user-supplied via /dev/passN CAMIOCOMMAND) is bcopyd verbatim into UCHAR Cdb[16] at entry.c:2782/2793 with no clamp anywhere in CAM (scsi_pass.c:546 xpt_merge_ccb copies it verbatim). Not reproduced at runtime because the audit guest has no HighPoint RR1820 controller (env.txt) and the trigger additionally requires SYSCAP_RESTRICTEDROOT (scsi_pass.c:308). Up to 239 bytes of chosen data smash the OsSendCommand stack frame.",
  "exploit_chain": "root -> /dev/passN on hptmv bus -> CAMIOCOMMAND cdb_len=200 -> 239-byte kernel stack smash -> ROP -> ring-0 (no SMEP/SMAP/KASLR on standard snapshot); not pursued: no hardware on guest, actor already root-class",
  "evidence": "VERDICT.md path:line trace (sys_generic.c:685 copyin -> scsi_pass.c:546 merge -> entry.c:2777/2782); env.txt documents absent 11ab:5081 PCI device; df3920.c is the exact CCB construction",
  "kernel_refs": [
    "sys/dev/raid/hptmv/entry.c:2771",
    "sys/dev/raid/hptmv/entry.c:2782",
    "sys/dev/raid/hptmv/entry.c:2793",
    "sys/bus/cam/scsi/scsi_pass.c:546",
    "sys/bus/cam/scsi/scsi_pass.c:308"
  ],
  "poc_changes": "n/a (first evidence pack; trigger authored fresh from the verified CAM path)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -o df3920 df3920.c (hardware-bearing host only)",
  "run_cmd": "sudo ./df3920 <hptmv-pass-unit> 200 (hardware-bearing host only)",
  "code_hash": "7a25bf74dfa5cb968a26260619b26ae021abe3f297b95b6c5aeb9215600cc4c1",
  "notes": "Hardware-gated: no RR1820 on the QEMU guest; only user-reachable CDB path into this SIM is /dev/passN which is root/operator+SYSCAP_RESTRICTEDROOT gated (0600 root:operator verified on guest). Severity Low per rubric (privileged + specific hardware) despite clean stack-smash primitive.",
  "recommended_fix": "Reject cdb_len > sizeof(Cdb) with CAM_REQ_INVALID before the bcopy (or clamp with imin())",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (entry.c: reject csio->cdb_len > sizeof(Cdb)); validation impossible on this guest - no hptmv controller to observe baseline vs patched behavior",
  "fix_evidence": "fix.diff in this pack; never applied to sys/ (read-only audit tree)"
}