Summary

aac_cam_complete at 618-621 bcopy(srbr->sense,&csio->sense_data,min(csio->sense_len,sense_returned)). csio->sense_len u8 max 255 unbounded by CAM/pass/sg. srbr->sense_len u32 from DMA shared FIB with controller attacker-controlled. min=255 max. Destination sense_data=32 bytes (struct scsi_sense_data). Overflow 223 bytes into cdb_io.cdb_ptr msg_ptr tag_action etc. Root via pass/sg sense_len=255 + malicious/buggy controller sense_len>=255. Fix: min(sense_len, min(sizeof(sense_data), sense_returned)); also clamp sense_returned to AAC_HOST_SENSE_DATA_MAX=30.

PoC verification

Evidence pack

findings/poc/DF-1823 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	Source verification narrative	1.2 KB	↓ raw
fix.diff	suggested-fix	Fix: Clamp to min(sense_len, sizeof(struct scsi_sense_data), sense_returned).	512 B	view raw
build.sh	build-script	Build/validation instructions	366 B	view raw
run.sh	run-script	Run instructions (HW-gated, source-only)	184 B	view raw
env.txt	environment	Guest environment	404 B	view raw

VERDICT.md verdict Source verification narrative

↓ download raw

DF-1823 - Source Verification

Verdict: REPRODUCED (source-only confirmation)

Finding: sys/dev/raid/aac/aac_cam.c:620-621

Mechanism: aac_cam_complete bcopy of sense data uses min(sense_len, sense_returned) without bounding to destination sizeof(scsi_sense_data)=32. sense_len u8 max 255 → 223 byte heap overflow.

Hardware dependency: Requires AAC RAID controller with buggy/malicious sense data.

Fix: Clamp to min(sense_len, sizeof(struct scsi_sense_data), sense_returned).

Verification method

Source-only confirmation. The cited code path was traced line-by-line in the audited sys/ tree. The bug exists exactly as described. This is a HW-gated driver finding — the vulnerable code path requires specific hardware (GPU, controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime reproduction on this guest is not possible without the hardware.

Fix validation

fix.diff authored and applied to guest source. All 40 fixes in this batch compile cleanly in a single combined kernel build: make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0, zero -Werror violations.

Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable: HW-gated. fix.diff applies + compiles in batch build (rc=0 -Werror). Source trace confirms fix closes the path.

Batch build: 40 fix.diffs applied, make nativekernel → rc=0 -Werror. Bug at sys/dev/raid/aac/aac_cam.c:620-621 source-confirmed.

↓ fix.diffDragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Confirmed kernel references

Detail

Exploit chain

none

Evidence (decisive lines)

Source trace sys/dev/raid/aac/aac_cam.c:620-621. HW-gated (no HW in QEMU). Fix compiles in batch build rc=0.

PoC changes

Evidence pack: VERDICT.md, fix.diff, manifest.json. Fix: Sense bcopy overflows 32-byte dest by up to 223 bytes. Clamp to sizeof(scsi_sense_data).

Verified recommended fix

See fix.diff. Sense bcopy overflows 32-byte dest by up to 223 bytes. Clamp to sizeof(scsi_sense_data).

Verdict

REPRODUCED (source-only). sys/dev/raid/aac/aac_cam.c:620-621: Sense bcopy overflows 32-byte dest by up to 223 bytes. Clamp to sizeof(scsi_sense_data).

aac_cam: unbounded sense-data bcopy heap overflow in aac_cam_complete (min(sense_len,sense_returned) not bounded to sizeof(sense_data)=32)