# DF-4810 — VERDICT

**Status: untested** (latent hardening finding; Phase V not applicable — the
hazard is provably unreachable in the tree as-is, `tag` hardcoded 0).

## Reproduced?

No — by design of the finding: there is no runtime path today that can place a
command table at `tag != 0`. The defect is an arithmetic inconsistency between
`ATA_AHCI_CT_SIZE` (256, ata-all.h:239) and the real size of
`struct ata_ahci_cmd_tab` (64+32+32+64×16 = 1152 bytes, ata-all.h:249-255,
`__packed`, `ATA_AHCI_CT_SG_OFFSET=128` confirming the 128-byte header). All
indexing and the hardware-visible `cmd_table_phys` (ata-ahci.c:254-255,
286-287) use the wrong stride, held safe only by `int tag = 0`
(ata-ahci.c:250, 343) inside the 8192-byte work allocation (`MAXWSPCSZ`,
ata-dma.c:55-56,130-145).

## Impact ceiling if the constraint is ever lifted (why filed at all)

- tag ≥ 1 → adjacent command tables overlap (stride < struct): silent
  cross-command FIS/PRD corruption.
- tag ≥ 28 → `1280 + 28×256 = 8448 > 8192`: `ctp->prd_tab` writes past the
  end of the bus_dmamem_alloc'd work area (kernel-heap OOB write, content =
  attacker-influenced DMA addresses), and the same OOB physical address is
  programmed into the AHCI command list for the engine to DMA through.

This is exactly the change a NCQ enablement patch would make, which is why the
constant deserves to be correct *before* that day. Filed as Info
(defense-in-depth, no demonstrated impact today), confidence certain (the
mismatch is a compile-time fact).

## Recommended fix

`ATA_AHCI_CT_SIZE 256 → 1152` + `_Static_assert` + move the
`KASSERT(nsegs <= ATA_AHCI_DMA_ENTRIES)` in `ata_ahci_dmasetprd`
(ata-ahci.c:544) above the write loop. See fix.diff (authored against the
read-only `sys/` tree, never applied). Runtime-neutral today because only
tag 0 is used.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.