=== BUILD df4240 ===
=== BUILD df4244 ===
=== RUN DF-4240 ===
DF-4240 dpt_attach() OOB write layout proof (x86-64)
sizeof region sims..sg_maps = 96 bytes, sims[3] would be at +%zu
&sims[3] == &paths[0] ? YES (offsets 24 vs 24)

MAX_CHAN=0 -> channels=1 (MAX_CHANNELS=3): all writes in bounds

MAX_CHAN=1 -> channels=2 (MAX_CHANNELS=3): all writes in bounds

MAX_CHAN=2 -> channels=3 (MAX_CHANNELS=3): all writes in bounds

MAX_CHAN=3 -> channels=4 (MAX_CHANNELS=3): 
  WRITE sims[3]  @+24 -> clobbers paths[]
  WRITE paths[3] @+48 -> clobbers commands_processed  ==> OOB WRITES into live softc members

MAX_CHAN=4 -> channels=5 (MAX_CHANNELS=3): 
  WRITE sims[3]  @+24 -> clobbers paths[]
  WRITE paths[3] @+48 -> clobbers commands_processed
  WRITE sims[4]  @+32 -> clobbers paths[]
  WRITE paths[4] @+56 -> clobbers parent_dmat (bus_dma_tag_t!)  ==> OOB WRITES into live softc members

MAX_CHAN=5 -> channels=6 (MAX_CHANNELS=3): 
  WRITE sims[3]  @+24 -> clobbers paths[]
  WRITE paths[3] @+48 -> clobbers commands_processed
  WRITE sims[4]  @+32 -> clobbers paths[]
  WRITE paths[4] @+56 -> clobbers parent_dmat (bus_dma_tag_t!)
  WRITE sims[5]  @+40 -> clobbers paths[]
  WRITE paths[5] @+64 -> clobbers dccb_dmat (bus_dma_tag_t!)  ==> OOB WRITES into live softc members

MAX_CHAN=6 -> channels=7 (MAX_CHANNELS=3): 
  WRITE sims[3]  @+24 -> clobbers paths[]
  WRITE paths[3] @+48 -> clobbers commands_processed
  WRITE sims[4]  @+32 -> clobbers paths[]
  WRITE paths[4] @+56 -> clobbers parent_dmat (bus_dma_tag_t!)
  WRITE sims[5]  @+40 -> clobbers paths[]
  WRITE paths[5] @+64 -> clobbers dccb_dmat (bus_dma_tag_t!)
  WRITE sims[6]  @+48 -> clobbers commands_processed
  WRITE paths[6] @+72 -> clobbers dccb_dmamap (bus_dmamap_t!)  ==> OOB WRITES into live softc members

MAX_CHAN=7 -> channels=8 (MAX_CHANNELS=3): 
  WRITE sims[3]  @+24 -> clobbers paths[]
  WRITE paths[3] @+48 -> clobbers commands_processed
  WRITE sims[4]  @+32 -> clobbers paths[]
  WRITE paths[4] @+56 -> clobbers parent_dmat (bus_dma_tag_t!)
  WRITE sims[5]  @+40 -> clobbers paths[]
  WRITE paths[5] @+64 -> clobbers dccb_dmat (bus_dma_tag_t!)
  WRITE sims[6]  @+48 -> clobbers commands_processed
  WRITE paths[6] @+72 -> clobbers dccb_dmamap (bus_dmamap_t!)
  WRITE sims[7]  @+56 -> clobbers parent_dmat (bus_dma_tag_t!)
  WRITE paths[7] @+80 -> clobbers sg_dmat (bus_dma_tag_t!)  ==> OOB WRITES into live softc members

Kernel consequence: bus_dma_tag_t/bus_dmamap_t fields are
overwritten with cam_sim*/cam_path* pointers (type confusion);
dpt_free()/dpt_detach later bus_dma_tag_destroy()s them
(dpt_scsi.c:1183,1198) -> wild pointer dereference.
=== RUN DF-4244 ===
DF-4244 dpt_detect_cache() walk model
device reports page length bytes=65539; actual DMA transfer=512; page=4096
walk stopped after 16383 accepted steps at buff+65536 (max)
reads OUTSIDE the 512-byte DMA buffer : 16257 iterations
  of which past the whole 4096B sg page: 15361 iterations (arbitrary adjacent kernel memory)
bound used by driver : &buff[bytes] = buff+65539
bound that is safe   : &buff[512] (the DMA'd length)

PROVEN: with a device-fed length of 65539, the walk accepts
pointers up to buff+65539 while only 512 bytes were DMA'd ->
kernel OOB read of up to 65027 bytes past the transfer buffer.
=== uname ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64