Summary

amr_cam_complete unconditionally aliases csio->data_ptr to a struct scsi_inquiry_data * pointer and then, whenever the user-supplied CDB opcode is INQUIRY (0x12), dereferences it via SID_TYPE(inq) and writes back via inq->device. If the CCB arrived with CAM_DIR_NONE (or otherwise with data_ptr == NULL, which CAM itself produces in cam_xpt.c:5943,6305), there is no data buffer and inq == NULL, producing a kernel page-fault panic.

Root cause

At amr_cam.c:557:

inq = (struct scsi_inquiry_data *)csio->data_ptr;

with no NULL check, regardless of CAM_DIR_MASK.

amr_cam_command never validates data_ptr either; it simply sets ac->ac_data = csio->data_ptr; (amr_cam.c:502) and, because CAM_DIR_NONE sets neither AMR_CMD_DATAIN nor AMR_CMD_DATAOUT, amr_mapcmd (amr.c:1664) skips bus_dmamap_load entirely when ac_data is NULL and just submits. On completion, the success path at amr_cam.c:583-589:

case 0:  /* completed OK */
    if (ac->ac_mailbox.mb_command == AMR_CMD_EXTPASS)
        cdb0 = aep->ap_cdb[0];
    else
        cdb0 = ap->ap_cdb[0];
    if ((cdb0 == INQUIRY) && (SID_TYPE(inq) == T_DIRECT))
        inq->device = (inq->device & 0xe0) | T_NODEVICE;

both reads (inq)->device (scsi_all.h:657 SID_TYPE macro) and writes it. With inq == NULL that is a fault on virtual page 0. amr_cam_action validates CDB length, lun, physical/sglist flags (amr_cam.c:256-287) but never validates that an INQUIRY opcode has a non-NULL data_ptr or non-zero dxfer_len.

Threat model & preconditions

• Attacker position: local user with write access to a MegaRAID passthrough /dev/passN node (typically mode 0660 group operator on DragonFlyBSD; members of the operator group; root trivially).
• Privileges gained or impact: local DoS (kernel panic). No privilege escalation since the deref is a pure read/write at address 0.
• Required config or capabilities: device amr MegaRAID controller present, /dev/passN attached to the amrp bus, operator group membership.
• Reachability: open /dev/passN, build a ccb_scsiio with cdb_io.cdb_bytes[0] = 0x12 (INQUIRY), flags = CAM_DIR_NONE, data_ptr = NULL, dxfer_len = 0, submit via CAMIOCOMMAND. If the MegaRAID firmware returns SUCCESS with scsi_status == 0 for the zero-length INQUIRY (behavior observed on multiple AMI/LSI firmware revisions that treat zero as a default allocation length), the kernel panics. Boot-time CAM probes are safe because probedb builds CCBs with real buffers.

Proof of concept

PoC source: findings/poc/DF-1840/amr_inq_null.c

Build & run

cc -o amr_inq_null amr_inq_null.c
# As a member of operator group:
./amr_inq_null

Expected output

Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0x0
...
amr_cam_complete+0x.. at 0x..

On firmwares that error-out instead of succeeding, the CCB returns CAM_REQ_CMP_ERR/CAM_SEL_TIMEOUT and the panic does not occur (hardware-dependent); test alternate targets/LUNs and an INQUIRY with EVPD=0, pagecode=0 to maximize the chance of a SUCCESS-without-data response.

Impact

Low-severity local DoS reachable from any member of the operator group on a system with a MegaRAID controller and /dev/passN passthrough. The dereference is a read/write at virtual page 0, so the floor is a clean panic; no escalation primitive was identified.

Recommended fix

Guard the INQUIRY branch against NULL/short data_ptr.

--- a/sys/dev/raid/amr/amr_cam.c
+++ b/sys/dev/raid/amr/amr_cam.c
@@ -583,11 +583,17 @@ amr_cam_complete(struct amr_command *ac)
        break;

     case 0:    /* completed OK */
    if (ac->ac_mailbox.mb_command == AMR_CMD_EXTPASS)
        cdb0 = aep->ap_cdb[0];
    else
        cdb0 = ap->ap_cdb[0];
-   if ((cdb0 == INQUIRY) && (SID_TYPE(inq) == T_DIRECT))
-       inq->device = (inq->device & 0xe0) | T_NODEVICE;
+   /*
+    * Hide direct-access disks so CAM does not pick them up as
+    * normal disks.  Only inspect/patch the inquiry buffer when
+    * the caller actually supplied one (CAM_DIR_NONE / data_ptr ==
+    * NULL is legal and must not be dereferenced).
+    */
+   if (cdb0 == INQUIRY && inq != NULL &&
+       csio->dxfer_len >= sizeof(struct scsi_inquiry_data) &&
+       SID_TYPE(inq) == T_DIRECT)
+       inq->device = (inq->device & 0xe0) | T_NODEVICE;
    csio->ccb_h.status = CAM_REQ_CMP;
    break;

If a smaller floor is preferred, csio->dxfer_len > 0 is the minimum to avoid the NULL page-0 fault, but >= sizeof(struct scsi_inquiry_data) is safer because the structure layout is then guaranteed in-bounds.

References

• CAM producing data_ptr == NULL: cam_xpt.c:5943, 6305.
• Missing validation in amr_cam_action: amr_cam.c:256-287.

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).