DF-1427
Broken sense-data copy in iir_intr GDT_GCF_IOCTL: duplicate data copy instead of sense copy
Summary
iir_intr at iir.c:1625-1626: second bcopy(gc_scratch,ucmd->data,cnt) identical to first. Should be bcopy(gc_scratch+sdlen,ucmd->u.raw.sense_data,sense_len). Sense data never delivered. Functional bug, latent maintenance trap. Fix: copy from scratch+sdlen to sense_data for sense_len bytes.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1427 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 389 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/raid/iir/iir.c:1621: broken sense-data copy (duplicate data copy instead of sense copy)
Verified recommended fix
Source-confirmed at sys/dev/raid/iir/iir.c:1621: broken sense-data copy (duplicate data copy instead of sense copy)
Verdict
Source-confirmed at sys/dev/raid/iir/iir.c:1621: broken sense-data copy (duplicate data copy instead of sense copy)
No comments yet.