# DF-4042 — Hostile SCSI target panics the kernel via MESSAGE REJECT of the driver's own MSG_ABORT/MSG_NOOP: amdsentmsg panic("Inconsistent msg buffer")

**File:** sys/dev/disk/amd/amd.c
**Severity:** Medium  |  **Class:** CWE-670 Always-Incorrect Control Flow Implementation (kernel panic on hostile input)
**Status:** hardware-gated — source-certain; runtime reproduction impossible on the audit guest
(no Polaris GPU / no AMD53C974 HBA — see env.txt). Verdict: `inconclusive`, confidence `certain`.

## Build & run (on the DragonFly guest)

    ./build.sh     # compiles the demonstrator (uses the guest's kernel headers)
    ./run.sh       # reproduces the exact index arithmetic / branch selection

Expected: the `DF-4042` section of run.log shows the OOB offsets / panic-branch selection / fault.
Full guest details in env.txt.

## Fix validation

fix.diff applied (with all DF-4036..DF-4044 patches together) to a clean guest /usr/src copy;
`make nativekernel KERNCONF=X86_64_GENERIC` completed with 0 errors under -Werror
(see fix_build.log — amd.o recompiled).
Sources restored to pristine afterwards (md5-verified).