# DF-4044 VERDICT — amdparsemsg MSG_DISCONNECT writes through NULL active_srb after an unexpected reselection

## Bottom line

Source-certain NULL write: on an unexpected reselection (untagged_srbs[t][l]==NULL and disc_count==0, amd.c:1834-1836) amd_Reselect leaves amd->active_srb NULL after queueing the ABORT (:1843 skipped). A hostile target that ignores ATN and clocks a MSG_DISCONNECT byte in MSG IN reaches amdparsemsg case MSG_DISCONNECT (amd.c:1217) which writes amd->active_srb->SRBState (:1218) — a NULL-page write fault in amd_intr context => kernel panic. The Q_TAG case guards active_srb!=NULL (:1229) and amdhandlemsgreject guards srb!=NULL (:1475); the DISCONNECT arm is the unguarded hole. Verified with a child process taking SIGSEGV on the exact store (run.log DF-4044). Hostile-target gated -> runtime inconclusive on this guest, source certain.

## Exploit chain

hostile target: reselect an idle target/lun (active_srb=NULL, driver queues ABORT) -> send MSG_DISCONNECT byte -> amd_MsgInPhase0:1188 -> amdparsemsg:1218 NULL write => panic

## Why not reproduced on the guest

The audit guest has no AMD53c974-compatible SCSI HBA (env.txt); amd(4) is compiled into the
GENERIC kernel (X86_64_GENERIC:88 `device amd`) but never attaches, so the hostile-target message
flows cannot be exercised at runtime. The exact walks were compiled from the driver source
(verbatim amdsentmsg copy / exact branch ladder / exact store) and driven with the real driver
states (run.log); the fix is compile-validated (fix_build.log).

## Negative results recorded alongside (pass-2 depth)

Kills proven in run.log: msgin_buf[6] per-byte walk max index 4 (bounded); SRB_array[msgin_buf[1]]
0..255 fits SRB_array[256] exactly; msgout shift bcopy fits msgout_buf[6]; amdtimeout/callout family
is #if 0 dead code (no timeout-vs-intr race); EEPROM word walks fit eepromBuf[128] exactly;
XPT_RESET_BUS ACBFlag race can only strand CCBs (hang, logged, not filed).

## Fix

NULL-guard active_srb in the MSG_DISCONNECT arm (skip the state store and disc_count bump; still complete the message). Applied and compile-validated on the guest (fix_build.log); sys/ tree never modified by the audit.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.