# DF-4654 — twa CAM shim: unchecked cdb_len overflows 16-byte firmware CDB field

**Files:** sys/dev/raid/twa/tw_osl_cam.c:276-280 (feed) → tw_cl_io.c:124 (sink)
          → tw_cl_fwif.h:307-315 (struct tw_cl_command_9k: TW_UINT8 cdb[16])
**Class:** CWE-787/CWE-120 out-of-bounds write — Medium, certain (code), hardware-gated
**Verdict:** NOT REPRODUCED on the audit guest (no 3ware 9000-series controller);
            defect proven by source trace + compiled trigger.

## Trigger
`twa_cdb.c`: scans /dev/pass* via CAMIOCOMMAND XPT_PATH_INQ looking for a
SIM named "twa"; when found, issues XPT_SCSI_IO with `csio.cdb_len = 255`
(CAM_CDB_POINTER, 0x41-filled). `tw_osli_execute_scsi()` copies cdb_len
unchecked into `scsi_req->cdb_len`; `tw_cl_start_io()` then does
`tw_osl_memcpy(cmd->cdb, scsi_req->cdb, scsi_req->cdb_len)` into the
16-byte `cdb[]` of the firmware command packet — up to 239 fully
attacker-controlled bytes past the field, into the contiguous
bus_dmamem_alloc'd command-packet pool (tw_osl_freebsd.c:575):
corrupts the packet's own SGL and the following request packets, which
the controller then DMA-reads/writes (device-mediated memory corruption).

## Guest result (run.log)
BUILD-OK; only SIM present is "ata" (QEMU DVD): "RESULT: no twa SIM
present on this system" — the overflow path cannot execute without
3ware 9xxx hardware. Reachability on real iron: pass(4) CAMIOCOMMAND
(root/operator) or any kernel CAM consumer issuing a >16-byte CDB.

## Fix
Clamp in tw_osl_cam.c: reject csio->cdb_len > sizeof(cmd->cdb) (16)
with CAM_REQ_INVALID before building scsi_req (see verdict.json fix).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)