{"finding_id":"DF-4798","status":"untested","attempts":0,"reproduced":0,"impact":"corruption","confidence":"certain","verdict":"Code-certain signed-overflow geometry lie, hostile-device-gated: u16 IDENTIFY heads/sectors are silently truncated into u8 softc fields, then total_secs = cylinders*heads*sectors is computed in promoted int arithmetic - cylinders=65535/heads=255/sectors=255 (from truncated 0x01FF) wraps negative and sign-extends to ~1.8e19 sectors in d_media_blocks, making dscheck bounds effectively unlimited so ad_strategy issues LBAs beyond real capacity (wrong-sector IO confined to the hostile device; 28-bit command path silently truncates). The truncation of heads 0x0100->0 is also the enabler of the known DF-1883/2489 div0. Not stageable on the audit guest without a custom device model; arithmetic certain by inspection. 64-bit-cast + nonzero-validate fix (also closes the div0 route).","exploit_chain":"crafted IDENTIFY (cyl=0xFFFF, heads=0x01FF, sect=0x01FF) -> int overflow -> total_secs ~= 1.8e19 -> unlimited dscheck bounds -> OOB-capacity LBAs","evidence":"findings/poc/DF-4798/ (this verdict)","kernel_refs":["sys/dev/disk/nata/ata-disk.c:471","sys/dev/disk/nata/ata-disk.c:477","sys/dev/disk/nata/ata-disk.c:479","sys/dev/disk/nata/ata-disk.c:143","sys/sys/nata.h:56-61"],"guest_uname":"","code_hash":""}