# DF-4876 — afd_sense() consumes uninitialized stack on short ATAPI responses

`sys/dev/disk/nata/atapi-fd.c:341-417`: `afd_sense()` declares three
**uninitialized stack structs** and passes them to `ata_atapicmd()`:

```c
struct afd_capacity capacity;        /* :345 */
struct afd_capacity_big capacity_big;/* :346 */
struct afd_capabilities capabilities;/* :347 */
...
if (!ata_atapicmd(dev, ccb1, (caddr_t)&capacity, sizeof(...), ATA_R_READ, 30)) {
    fdp->sectorsize = be32toh(capacity.blocksize);
    fdp->mediasize  = (u_int64_t)be32toh(capacity.capacity) * fdp->sectorsize; ...
...
    if (!ata_atapicmd(dev, ccb3, (caddr_t)&capabilities, 40, ATA_R_READ, 30) &&
        capabilities.page_code == ATAPI_REWRITEABLE_CAP_PAGE) {
        fdp->heads      = capabilities.heads;          /* struct offset 12 */
        fdp->sectors    = capabilities.sectors;        /* offset 13 */
        fdp->sectorsize = be16toh(capabilities.sector_size);  /* 14-15 */
        fdp->mediasize  = be16toh(capabilities.cylinders) *   /* 16-17 */
                          fdp->heads * fdp->sectors * fdp->sectorsize;
```

`ata_atapicmd()` (sys/dev/disk/nata/ata-queue.c:188-214) issues the packet
command and returns `request->result`. ATAPI data-in phases routinely
**underrun** (device returns fewer bytes than the allocation length) while
still completing with success status — `donecount < bytecount` is not an
error in the nata completion path. The kernel never zeroes `request->data`.

Therefore a device that returns, e.g., an 8-byte MODE SENSE(10) response
(header only) or a truncated capabilities page leaves
`capabilities.heads/sectors/sector_size/cylinders` (offsets 12..17) as
**stale kernel stack bytes**, which are then:

1. multiplied into `fdp->mediasize` (u32 wrap already tracked as DF-2508)
   and published as disk geometry via `disk_setdiskinfo()` (atapi-fd.c:217)
   — a (weak) kernel-stack info leak observable through the disk-info
   ioctls, and
2. used as divisors/geometry in `afd_open()` (atapi-fd.c:211-215) and
   `afd_strategy()`'s LBA math (atapi-fd.c:258-259), producing garbage I/O
   placement; a zero divisor here is pre-conditioned by the `!mediasize`
   guard, but arbitrary non-zero garbage is not.

Only `capabilities.page_code` (offset 8) is validated (:405) — the
consumed fields sit past it.

## Status: untested (in situ) — requires an ATAPI direct-access device

Same blocker as DF-4874/4875: the audit guest cannot attach an `afd`
device (QEMU 7.2 has no ATAPI direct-access emulation), so a short-response
device cannot be presented. The defect is established by trace:
`ata_atapicmd()` never zeroes the buffer, short-but-successful ATAPI
data-in is not an error (ata-queue.c:188-214 + nata interrupt completion),
and the struct fields past the validated page_code are consumed directly
(atapi-fd.c:406-410).

## Fix

`fix.diff`: `bzero()` all three response structs before each command, so a
short device response yields zeros (which the existing `!mediasize` /
ENXIO paths then reject cleanly) instead of stale stack.