# DF-5463 VERDICT

## Status: REPRODUCED (deterministic), fix validated on the guest

## Root cause

`ptioctl()` PTIOCSETTIMEOUT (sys/bus/cam/scsi/scsi_pt.c:648-656):

```c
if (*(int *)addr < 1) {          /* only the LOWER bound is checked */
        error = EINVAL;
        break;
}
softc->io_timeout = *(int *)addr * 1000;   /* :654 signed overflow */
```

For `*(int *)addr >= 2147484` the int multiply wraps (UB) and
`softc->io_timeout` goes negative. It is consumed as a `u_int32_t`
millisecond CDB timeout by `ptstart()` :483 → `scsi_send_receive()`
:691 (`cam_fill_csio` timeout) — e.g. 2147484 becomes
-2147483296 → 0x8007A120 as u_int32 (a ~35.8 minute-wall-clock... as far
in the wrong direction as the value allows; the point is the driver
accepted and silently mangled it). `PTIOCGETTIMEOUT` (:642-646) maps
any `io_timeout < 1000` to 0, making the wrap directly observable:

## Reproduced (guest, root, EVILPT kernel #0 / unfixed)

`run.log`:

    set=100000     -> get=100000
    set=2147483    -> get=2147483
    set=2147484    -> get=0          <-- wrapped negative
    OVERFLOW-MANIFEST: io_timeout wrapped negative

## Impact ceiling

Root-gated knob self-corruption (the caller already passed
`caps_priv_check_self(SYSCAP_RESTRICTEDROOT)` at open): no memory
safety impact, no cross-privilege effect. Signed-overflow UB /
silent-misconfiguration hardening finding (Info).

## Fix validated (guest, kernel #1 22:30:30 with fix.diff)

`fix.diff` rejects `*(int *)addr > 2147483` (INT_MAX/1000) with EINVAL.
`run.patched.log`:

    set=100000     -> get=100000
    set=2147483    -> get=2147483
    set=2147484    -> get=2147483    <-- rejected, previous value kept;
                                         no OVERFLOW-MANIFEST line

The overflow manifestation is gone; in-range behavior unchanged.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.