{
  "finding_id": "DF-4988",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated (no 3ware controller on the audit guest; PoC builds clean and exits ENOENT, run.log). The OOB write is proven by exact size arithmetic: tws_user.c:126 copies the users 896-byte command including the generic size byte; for non-EXECUTE_SCSI opcodes tws_cam.c:1035 computes the SGL destination as gcmd + 4*gcmd->size (gcmd->size user-controlled 0..255) and tws_cam.c:1038/1053-1100 writes up to 46 16-byte descriptors there \u2014 with size=255 the window ends at cmd_pkt+1884 vs the 1024-byte packet, i.e. up to ~860 bytes past this requests packet into the neighboring request packets of the shared dma_mem pool (tws.c:463-636). nseg is tag-bounded (46); the destination is not bounded at all. Root-gated 0600 device + hardware gate -> Low severity, CWE-787.",
  "exploit_chain": "",
  "evidence": "run.log (clean build + ENOENT + pciconf: no LSI device); VERDICT.md (geometry with all struct sizes cited from tws_hdm.h); tws_pt_sgl.c (constructs opcode=0x01 + gcmd.size=255 passthru command)",
  "kernel_refs": [
    "sys/dev/raid/tws/tws_user.c:126",
    "sys/dev/raid/tws/tws_cam.c:1030-1038",
    "sys/dev/raid/tws/tws_cam.c:1053-1100",
    "sys/dev/raid/tws/tws.c:463-464",
    "sys/dev/raid/tws/tws.c:598-636",
    "sys/dev/raid/tws/tws.h:92-93"
  ],
  "poc_changes": "n/a (authored fresh); struct mirrors inline so the PoC builds against stock guest headers",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o tws_pt_sgl tws_pt_sgl.c",
  "run_cmd": "./tws_pt_sgl 255",
  "code_hash": "3c2863621af0ca7a572912951d464241f4b9c338cd9c874bd51f3837a9d43990",
  "notes": "Cross-request corruption inside the pool allocation (slot 2 -> slots 3/4); tws_get_request clears only .cmd, never .hdr, so corrupted sense headers persist into later reuse. Root-only device; family calibration (DF-4438 Low) applied.",
  "recommended_fix": "In tws_passthru reject non-SCSI commands whose gcmd->size would place the maximum-length SGL outside the 1024-byte command packet (128 + 4*size + max_sgls*entsize <= 1024)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated; fix.diff adds the destination-bound check before submission, making the out-of-packet SGL write unreachable by construction."
}