Summary

scsi_encap() validates csio->cdb_len only on the CAM_CDB_POINTER path. When a CCB is submitted without CAM_CDB_POINTER (i.e. using the inline cdb_io.cdb_bytes array), cdb_len > 16 falls through to a memcpy of csio->cdb_len bytes into cmd->cdb (int[4] = 16 bytes), overflowing into pdu_t.ahs / ahs_len / ahs_size / hdr_dig. The function only logs an xdebug("guevalt!") warning — evidence the case has been observed in the field.

Root cause

At iscsi_subr.c:494-505 the bounds check is structurally inside the CAM_CDB_POINTER branch:

if((ccb_h->flags & CAM_CDB_POINTER) != 0) {
    if(csio->cdb_len > 16) goto invalid;    /* only on POINTER path */
}
/* NOTE: no else clause -- non-POINTER falls through */

if(csio->cdb_len > sizeof(cmd->cdb))
    xdebug("guevalt! %d > %ld", ...);       /* warns but does NOT reject */

memcpy(cmd->cdb, ..., csio->cdb_len);       /* unconditional overflow */

cmd->cdb is int cdb[4] = 16 bytes (iscsi.h:146), at the end of scsi_req_t which fills the 48-byte BHS union. Past cmd->cdb are pdu_t.ahs (pointer), ahs_len, ahs_size, hdr_dig. A corrupted ahs pointer + ahs_len becomes an arbitrary kernel-memory-read into an outgoing PDU via isc_sendPDU (isc_soc.c:120-130).

Threat model & preconditions

• Attacker position: local root (or a kernel periph that missets cdb_len) via /dev/passN CAM pass-through (mode 0600 root).
• Privileges gained or impact: kernel heap write of (cdb_len - 16) bytes of CCB-supplied data into pdu_t pointer/length fields. With a subsequent isc_sendPDU this can pivot to an arbitrary kernel-memory read over the network. In a jail-with-root or capability-delegation deployment this grants kernel heap corruption from a contained context.
• Required config or capabilities: device iscsi_initiator; session up; local root.
• Reachability: submit a XS_IO CCB via /dev/passN without CAM_CDB_POINTER with cdb_len > 16.

Recommended fix

Bound cdb_len unconditionally before the memcpy.

--- a/sys/dev/disk/iscsi/initiator/iscsi_subr.c
+++ b/sys/dev/disk/iscsi/initiator/iscsi_subr.c
@@ -506,6 +506,9 @@
       if(csio->cdb_len > sizeof(cmd->cdb))
      xdebug("guevalt! %d > %ld", csio->cdb_len, (long)sizeof(cmd->cdb));
+      if(csio->cdb_len > sizeof(cmd->cdb))
+     goto invalid;
+
       memcpy(cmd->cdb,

References

• Sibling write-what-where: DF-1869 (this file).
• Sibling OOB read: DF-1870 (this file).

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).