# DF-4875 — afd_describe() 1-byte stack NUL overflow via device-controlled mediasize

`sys/dev/disk/nata/atapi-fd.c:446-451`:

```c
char sizestring[16];
if (fdp->mediasize > 1048576 * 5)
    ksprintf(sizestring, "%juMB", fdp->mediasize / 1048576);
```

`mediasize` (u_int64_t) is fully device-controlled:
* READ_CAPACITY path (atapi-fd.c:384): `(u64)be32toh(capacity) * blocksize`
  → up to (2^32-1)^2 ≈ 1.84e19;
* READ_CAPACITY_16 path (atapi-fd.c:396): `be64toh(capacity) * blocksize`
  computed in u64 (wraps mod 2^64) → **any** 64-bit value.

`mediasize/1048576` can therefore have up to 14 decimal digits, and
`"%juMB"` renders 14 + 2 + NUL = **17 bytes into `char sizestring[16]`** —
a 1-byte (NUL) stack buffer overflow at device attach time.

## Proof

See `proof.txt` (generated by `proof.c`; pure arithmetic, host-side):

```
path1 READ_CAPACITY : cap=blocksize=0xFFFFFFFF -> '17592186036224MB' = 16 chars + NUL = 17 bytes -> OVERFLOW
path2 READ_CAP_16   : cap=2^64-1,blocksize=1   -> '17592186044415MB' = 16 chars + NUL = 17 bytes -> OVERFLOW
```

The lowest triggering mediasize is 10^13 MiB ≈ 1.05e19 (e.g. a device
answering READ_CAPACITY_16 with capacity ≥ 2.44e16 sectors @512B, or
READ_CAPACITY with maxed capacity+blocksize fields).

## Status: untested (in situ) — proof is arithmetic

The write is deterministic the moment a (crafted, buggy or wedged) ATAPI
floppy reports an oversized capacity; no runtime is needed to establish
the 17 > 16 fact. On-guest execution is blocked because the audit guest
cannot host an ATAPI direct-access device (QEMU 7.2: only ide-hd/ide-cd;
see env.txt and the DF-4874 pack for the recorded blocker).

## Impact ceiling

One NUL byte one past a 16-byte stack local in `afd_describe()`, at attach.
Depending on compiler frame layout it can land on an adjacent local pointer
(`ch`/`atadev`/`fdp`) and turn later `device_printf` derefs into a faulted
pointer — a device-triggered kernel memory-corruption primitive of very
limited range (fixed value 0x00, fixed position). Crafted-hardware class.

## Fix

`fix.diff` (git-apply-able, checked): enlarge to `char sizestring[32]` and
switch to `ksnprintf()` with the buffer size so no device input can ever
overflow it.