DF-1029 — VERDICT

Verdict

NOT REPRODUCED (live) — bug CONFIRMED via code trace, fix.diff compiles cleanly.

The OOB heap read via unchecked blk_desc_len is real and the cited line numbers are exact, but it cannot be exercised on the audit guest for the same reason as DF-1028: there is no SCSI medium-changer device, so no ch peripheral attaches and the vulnerable code paths (chstart → chdone, and chgetparams) never run. The bug is latent on this guest and live on any host that attaches a SCSI changer; unlike DF-1028, the trigger is automatic at probe time — no userland cooperation is required.

Mechanism (code trace)

find_mode_page_6() at sys/bus/cam/scsi/scsi_all.h:1418-1427:

static __inline void *
find_mode_page_6(struct scsi_mode_header_6 *mode_header)
{
    void *page_start;
    page_start = (void *)((u_int8_t *)&mode_header[1] +
                          mode_header->blk_desc_len);
    return(page_start);
}

blk_desc_len is a u_int8_t at offset 3 of struct scsi_mode_header_6 (scsi_all.h:956-962) — i.e. a byte the device fully controls in its MODE SENSE response. The function adds that byte to &mode_header[1] (= mode_header + 4) with NO bounds check, so a blk_desc_len == 0xFF (255) makes page_start point 259 bytes into a buffer that may be far smaller.

chstart at sys/bus/cam/scsi/scsi_ch.c:485-519 allocates the probe mode buffer with:

mode_buffer_len = sizeof(struct scsi_mode_header_6) +   // 4
                  sizeof(struct scsi_mode_blk_desc)  +   // 8
                  sizeof(struct page_element_address_assignment);  // 20
// total = 32 bytes

If the device lies and returns blk_desc_len == 0xFF, find_mode_page_6(mode_header) returns mode_buffer + 4 + 255 = mode_buffer + 259 — 227 bytes past the 32-byte allocation.

Three call sites then dereference that OOB pointer:

• sys/bus/cam/scsi/scsi_ch.c:546-547 (probe path, chdone): reads ea->mtea/nmte/fsea/nse/fieea/niee/fdtea/ndte (16 bytes) into softc->sc_firsts[] / sc_counts[].
• sys/bus/cam/scsi/scsi_ch.c:1409-1419 (chgetparams, element page): same 16-byte read of ea-> into softc->sc_firsts[] / sc_counts[].
• sys/bus/cam/scsi/scsi_ch.c:1474-1484 (chgetparams, cap page): reads cap->move_from[] / exchange_with[] (16 bytes) into softc->sc_movemask[] / sc_exchangemask[].

Some of the resulting softc fields are then exposed to userspace via CHIOGPARAMS (slot counts). This is an automatic OOB read at device-probe time — no userland action needed beyond attaching the device.

Why it does not reproduce on this guest

Same as DF-1028: no SCSI device type 8 (medium changer) is present, so no ch peripheral attaches and chstart/chdone/chgetparams never run. The cam.ko module is loaded (QEMU DVD-ROM uses CAM), but the ch driver only matches T_CHANGER.

Exploit chain

none — pure OOB heap read (CWE-125) at probe time. Read size is up to ~16 bytes per call site, fed into softc state that is partially readable by CHIOGPARAMS (root-only). On a malicious-changer scenario, the read ceiling is bounded by the slab bucket / page adjacency of the 32-byte probe mode_buffer.

Fix

fix.diff adds a small static __inline int ch_mode_header_sane() helper that requires mode_header->blk_desc_len <= buflen - sizeof(*mode_header), and calls it at all three call sites before find_mode_page_6(). On a bogus value the driver logs a diagnostic and bails (probe announcement becomes empty; chgetparams returns EIO). This is a minimal, root-cause fix that matches the finding's "validate blk_desc_len against buffer size before find_mode_page_6" recommendation.

Fix validation

• fix.diff applies cleanly to /usr/src/sys/bus/cam/scsi/scsi_ch.c with patch -p1 (4 hunks all succeeded; 2 with a 23-line offset because the helper was inserted above the first call site — patch auto-applied the offset).
• The patched cam.ko module (which contains scsi_ch.o) compiles cleanly with -Werror (see fix_build.log).
• Not live-tested (no SCSI changer device to attach).

fix_status: not_testable (no live trigger available).

PoC changes

The finding folder was empty; this run authored: - poc.c — documentation harness - fix.diff — the verified fix - build.sh, run.sh, build.log, run.log, env.txt, fix_build.log, manifest.json, VERDICT.md