{
  "finding_id": "DF-4185",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "acd_fixate() divides by (cdp->cap.cur_write_speed / 177); acd_get_cap() only assigns cur_write_speed (>=177) on a successful capabilities MODE SENSE, so a device whose five cap reads fail at attach leaves the field 0 and the very first CDRIOCFIXATE that gets past CLOSE TRACK takes an integer-divide fault: reproduced as Fatal trap 18: integer divide fault, Stopped at acd_ioctl+0x1842: idivl %ecx,%eax on the audit guest using device-state emulation (cap senses forced to fail at attach, burner commands accepted), driver source unmodified. Impact is a kernel panic / local DoS (faulting divide, no write primitive). Caller must pass the disk-layer RESTRICTEDROOT gate, so the practical trigger is root/RESTRICTEDROOT burning software against a failing or crafted drive.",
  "exploit_chain": "",
  "evidence": "panic.txt (Fatal trap 18 + idivl backtrace from the serial console); panic_serial_full.log (full acd_fixate command trace up to the trap, incl. the DF-4184 over-read re-capture); ../DF-4184/fix.2.log (patched kernel, same attack, division path executed, no trap)",
  "kernel_refs": [
    "sys/dev/disk/nata/atapi-cd.c:1158",
    "sys/dev/disk/nata/atapi-cd.c:1706",
    "sys/dev/disk/nata/atapi-cd.c:144"
  ],
  "poc_changes": "trigger binary shared with DF-4184; emulation tunables df_audit.capfail=1 (fail all page-0x2a senses at attach, emulating a failing/crafted drive) + df_audit.mode=1 (accept burner-only commands so acd_fixate reaches the division)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5/#6 x86_64 (audit guest, QEMU 7.2 IDE DVD-ROM, 16MiB raw medium inserted)",
  "runtime_sec": 900,
  "guest_dirty": 1,
  "build_cmd": "guest: cc -O -o /tmp/fixate_stackread /tmp/fixate_stackread.c ; kernel: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC",
  "run_cmd": "/tmp/fixate_stackread /dev/acd0   (tunables: df_audit.mode=1 df_audit.capfail=1)",
  "code_hash": "e1a688ff932d16a09c22db3c127211b4126b6b787c833508723f9395036976de",
  "notes": "trap 18 is a faulting divide - no memory corruption; impact ceiling is repeatable local DoS while the speed field is 0.",
  "recommended_fix": "clamp the divisor in acd_fixate (write_speed < 177 -> 177); alternatively default cur_write_speed to 177 in acd_get_caps failure path",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff divisor clamp applied on the same emulation kernel with the same attack (capfail=1, valid page_length): the traced run reaches TEST_UNIT_READY != EBUSY (the division executes) and completes the ioctl without any trap, guest stays up; identical configuration on the unpatched kernel panics with trap 18",
  "fix_evidence": "baseline: panic.txt (Fatal trap 18, idivl %ecx,%eax); patched: ../DF-4184/fix.2.log (survived (no panic), hook ccb0=00 ... err=5 showing the != EBUSY division path taken)",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #6: Fri Sep 18 12:49:47 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}