{
  "finding_id": "DF-5551",
  "status": "reproduced",
  "reproduced": true,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "camq_insert()s full-queue guard (cam_queue.c:148-151) is #ifdef DIAGNOSTIC-only and compiled out of stock kernels. Harness T3 on the unmodified production kernel: inserting a 5th entry into a 4-capacity camq wrote queue_array[5] -- a kernel pointer one slot past the kmallocd array -- set entries=5 > array_size=4, and overwrote the adjacent canary chunk (CORRUPTED at +0: d0 (was a5)). Post-fix (same fix.diff hunk 2, validated in DF-5550s pack) the insert is refused: entries stays 4, all canaries intact.",
  "exploit_chain": "kldload camqtest.ko; sysctl debug.camqtest.run=3 -> one-pointer heap OOB write past an M_CAMQ array + entries=array_size+1 persistent corruption; every later heap_up/heap_down/camq_remove on that queue then walks past the array. Standalone reachability needs an accounting drift (e.g. the DF-5550 corrupted state); no uid=0 chain developed.",
  "evidence": "DF-5550/run.log T3 lines: T3 after: entries=5 array_size=4 (wrote queue_array[5] == ... PAST the array) + canary 63 ... CORRUPTED; DF-5550/fix_run.log: entries=4 array_size=4 ... all 64 canaries intact",
  "kernel_refs": [
    "sys/bus/cam/cam_queue.c:145-157",
    "sys/bus/cam/cam_queue.c:148-151",
    "sys/bus/cam/cam_queue.c:152-156"
  ],
  "poc_changes": "authored fresh; shares camqtest.ko with DF-5550 (T3 is this findings test)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (see DF-5550 pack)",
  "run_cmd": "kldload ./camqtest/camqtest.ko; sysctl debug.camqtest.run=3",
  "code_hash": "6a5ffd59641523361395cdc99059d226b3b77080cd5aee05699e33629e792358",
  "notes": "Low/Info-adjacent hardening on its own (no in-tree caller provably exceeds capacity without the DF-5550 state); filed separately because the sink, guard line and fix hunk are distinct.",
  "recommended_fix": "unconditionally refuse the insert when entries >= array_size (see DF-5550 fix.diff hunk 2)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "same patched-kernel validation run as DF-5550: insert refused, entries==array_size==4, all canaries intact; baseline corruption gone.",
  "fix_evidence": "DF-5550/fix_run.log T3 section vs DF-5550/run.log T3 section"
}