{
  "finding_id": "DF-4053",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "REPRODUCED on a live vtscsi0 (guest booted with a temporary -device virtio-scsi-pci launcher): every CHECK CONDITION returns CAM_AUTOSNS_VALID over an all-zero sense buffer (sense_resid proves the device delivered 18 real sense bytes; camcontrol prints Sense Error Code 0x0) because virtio_scsi.c:1393 copies FROM the just-bzero()ed csio->sense_data INTO cmd_resp->sense \u2014 dst/src swapped vs FreeBSD release/11.4.0. The same length math is device-influenced (len = min(device sense_len, ccb sense_len)); with an unvalidated pass(4) CAMIOCOMMAND sense_len up to 255 and a malicious backend announcing >=97, the 96-byte vsr_uresp.cmd.sense destination overflows ~159 bytes over vsr_callout/vsr_link and ~80 bytes past the contigmallocd struct vtscsi_request (TAILQ_REMOVE then yields a shaped write) \u2014 source-certain, but stock QEMU clamps device sense_len to 96, so the write half cannot fire on an unmodified QEMU; only the reversed-copy functional break was live (impact=none at runtime). Fix (restore direction + MIN(len, sizeof(sense_data))) validated: rebuilt kernel #1 delivers the real sense 70 00 05 ... 21 00 and camcontrol decodes ILLEGAL REQUEST asc:21,0 Logical block address out of range.",
  "exploit_chain": "unmodified-QEMU ceiling: broken autosense only. Malicious-device chain (not exercisable on stock QEMU): root opens /dev/pass0 -> CAMIOCOMMAND XPT_SCSI_IO with csio.sense_len=255 (merged wholesale by xpt_merge_ccb, no validation) -> device returns cmd_resp.sense_len>=97 -> vtscsi_complete_scsi_cmd_response memcpy writes up to 255 bytes into vsr_uresp.cmd.sense[96] -> vsr_callout func/arg and vsr_link next/prev corrupted (16 user-controlled CDB bytes at known offset) -> vtscsi_dequeue_request TAILQ_REMOVE performs *tqe_prev=tqe_next (shaped arbitrary write) -> kernel code execution in guest context. Device+root preconditions cap severity at Medium.",
  "evidence": "run.log (baseline: all-zero sense + resid 237/14 => device returned 18 bytes), run.patched.log (fix: 70 00 05 ... 21 00 real sense), env.txt (vtscsi0/da0/pass0, guest uname, camcontrol devlist), fix_build.log (nativekernel RC=0 + installkernel + uname #1), VERDICT.md, sense_test.c",
  "kernel_refs": [
    "sys/dev/virtual/virtio/scsi/virtio_scsi.c:1392",
    "sys/dev/virtual/virtio/scsi/virtio_scsi.c:1393",
    "sys/dev/virtual/virtio/scsi/virtio_scsi.h:53",
    "sys/dev/virtual/virtio/scsi/virtio_scsivar.h:125",
    "sys/bus/cam/cam_ccb.h:602",
    "sys/bus/cam/scsi/scsi_all.h:953",
    "sys/bus/cam/scsi/scsi_pass.c:546",
    "sys/bus/cam/cam_xpt.c:3888"
  ],
  "poc_changes": "PoC authored fresh (no seed): sense_test.c uses bus/cam headers (guest has no cam/ userland path) + libcam; required explicit bootindex=0 on the root virtio-blk device or SeaBIOS hangs when the scsi-hd is attached.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1740,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o /tmp/sense_test /tmp/sense_test.c -lcam",
  "run_cmd": "/tmp/sense_test 255; /tmp/sense_test 32; camcontrol cmd da0 -v -i 512 - -c \"28 00 ff ff ff f0 00 00 01 00\"",
  "code_hash": "3e8fa759963efbad43c9566c835c60b8537292c5fa98342f78a5552162e7d21b",
  "notes": "vm.sh untouched; temporary launcher dfbsd-qemu/vm-vtscsi.sh + 64MB vtscsi-disk.img used and removed afterwards. Baseline kernel #0 and patched kernel #1 both tested with identical triggers; only delta is fix.diff. /tmp wiped by validation reboot ate kbuild.log - decisive lines quoted verbatim in fix_build.log.",
  "recommended_fix": "Restore FreeBSD copy direction and clamp: memcpy(&csio->sense_data, cmd_resp->sense, MIN(csio->sense_len - csio->sense_resid, sizeof(csio->sense_data)));",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Batched build+install+reboot validated: baseline kernel #0 shows zeroed sense (bug live); patched kernel #1 delivers 70 00 05 ... 21 00 and camcontrol decodes ILLEGAL REQUEST asc:21,0 \u2014 reversed-copy behavior GONE with both fixes compiled in.",
  "fix_evidence": "run.log vs run.patched.log; fix_build.log (RC=0, install completed, uname #1)"
}