# DF-5374 VERDICT

## Status: REPRODUCED (panic / local DoS), fix validated

## Root cause
`targwrite()` and `targread()` dereference `softc->periph` without any
state check. `softc->periph` is set only by `targctor()`
(scsi_target.c:522), i.e. by a successful `TARGIOCENABLE`;
`targopen()` (scsi_target.c:168-204) leaves it NULL. Every pre-enable
read(2)/write(2) executes `cam_periph_lock(NULL)` =
`CAM_SIM_LOCK(periph->sim)` (cam_periph.h:186-190) → NULL+0x40 read.

## Guest evidence (baseline, kernel `option targ`, X86_64_GENERIC #0 Sat Oct 3 17:18:54)
- write() path, `./poc5374 w` (root):
  - serial console: `Fatal user address access from kernel mode from
    poc5374 at ffffffff802c9930` / `Fatal trap 12: page fault while in
    kernel mode` / `fault virtual address = 0x40` /
    `Stopped at targwrite+0x130: movq 0x40(%rax),%rax` (panic.txt).
    Fault VA 0x40 = offsetof(struct cam_periph, sim); rax = NULL periph.
  - Guest stops in DDB; ssh dead. Deterministic, no race, no setup
    beyond opening the device.
- read() path (`targread`, scsi_target.c:874): identical deref shape;
  not re-run live after the write-mode panic proved the primitive
  (same NULL periph, same lock call, cited by source).
- Unprivileged user (maxx): `open: Permission denied` — the clone node
  is created 0600 root:wheel (make_autoclone_dev, scsi_target.c:1060)
  and targopen() enforces SYSCAP_RESTRICTEDROOT, so the stock-guest
  attacker is the (possibly compromised/buggy) privileged target daemon
  or any operator granted the device via devfs rules.

## Impact
Deterministic local kernel panic (DoS) from one 8-byte write(2) on a
freshly opened /dev/targ — before any LUN is enabled. No race window.

## Exploitability beyond DoS
None for this primitive itself (NULL deref only), but it is a zero-cost
reliable crash primitive for the daemon attack surface.

## Fix validation
fix.diff adds the missing state checks (ENXIO when not enabled).
Patched kernel (#2 Sat Oct 3 18:13:09 and #3):
- `./poc5374 w` → `write returned -1 (errno=6 ENXIO) - NO PANIC`
- `./poc5374 r` → `read returned (errno=6) - NO PANIC`
- guest alive. Baseline panic gone. FIXED.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.