DF-2069 PoC — ata_serverworks_tf_write CHS divide-by-zero

Status: VERIFIED (source-only) + FIX VALIDATED

ata-serverworks.c:228/230/232/234 divides by sectors and sectors*heads loaded from IDENTIFY without the current_heads && current_sectors guard that the sibling ata-disk.c:469-470 applies. A device that sets ATA_FLAG_54_58 but reports current_sectors == 0 makes the next I/O request divide by zero → kernel panic.

HW-gated on the audit guest (virtio-only, no ServerWorks ATA controller). See VERDICT.md for the source trace and fix validation.

Reproduce

./build.sh   # rebuilds the patched kernel (rc=0 with -Werror)
./run.sh     # source-only confirmation; no runtime PoC (HW-gated)

Fix

fix.diff adds the missing current_heads && current_sectors clause to the atavalid check (matching ata-disk.c:469) plus a final if (heads == 0 || sectors == 0) { request->result = EIO; return; } defense before the divisions.

DF-2069 — REPRODUCED (source-confirmed, HW-gated) + FIX VALIDATED

Verdict

REPRODUCED via source-only trace. The CHS-path divide-by-zero in ata_serverworks_tf_write is real: the function reads current_heads/ current_sectors from IDENTIFY without the current_heads && current_sectors guard that the sibling geometry-adoption code in ata-disk.c applies. The bug is HW-gated on this guest (no ServerWorks PCI ATA controller present), so there is no runtime PoC.

Mechanism (path:line)

ata_serverworks_tf_write is wired into the channel's hw.tf_write vector at sys/dev/disk/nata/chipsets/ata-serverworks.c:158. Its CHS branch:

• sys/dev/disk/nata/chipsets/ata-serverworks.c:219 (original) c if (atadev->param.atavalid & ATA_FLAG_54_58) { heads = atadev->param.current_heads; sectors = atadev->param.current_sectors; } else { ... } ATA_IDX_OUTW(ch, ATA_SECTOR, (request->u.ata.lba % sectors)+1); /* :228 */ ATA_IDX_OUTW(ch, ATA_CYL_LSB, (request->u.ata.lba / (sectors*heads))); /* :230 */ ATA_IDX_OUTW(ch, ATA_CYL_MSB, (request->u.ata.lba / (sectors*heads)) >> 8); /* :232 */ ATA_IDX_OUTW(ch, ATA_DRIVE, ... ((request->u.ata.lba%(sectors*heads))/sectors)&0xf); /* :234 */

If ATA_FLAG_54_58 is set in atavalid but current_sectors == 0 (observed on misbehaving / emulated ATA devices that set the validity bit but report zero geometry), sectors is 0 and every CHS expression divides by zero → kernel divide-by-zero trap → panic.

The sibling geometry-adoption code refuses the bad geometry:

• sys/dev/disk/nata/ata-disk.c:469-470 c if ((atadev->param.atavalid & ATA_FLAG_54_58) && atadev->param.current_heads && atadev->param.current_sectors) { adp->heads = atadev->param.current_heads; ...

ata-disk.c correctly adds the current_heads && current_sectors clause; ata-serverworks.c did not. The result is that ata-disk.c:ad_invalidate() falls through to the safe param.heads/ param.sectors branch but the very next I/O request that calls tf_write panics the kernel.

Reachability / impact ceiling

HW-gated. Requires a ServerWorks ATA PCI controller (ROSB4/CSB5/CSB6/ HT1000/Frodo/K2 family — ata-serverworks.c:47-59) with a disk whose IDENTIFY data sets ATA_FLAG_54_58 but reports current_sectors == 0. The audit guest is virtio-only and has no such controller. If reachable, the impact is panic / local DoS (CVSS A:H). No memory-corruption primitive is derivable from a divide-by-zero trap.

Fix

fix.diff:

1. Adds the && current_heads && current_sectors clause to the if at line 219 so the safe param.heads/param.sectors fallback is used when the current_* fields are bogus (matches ata-disk.c:469-470).
2. Adds a final defensive if (heads == 0 || sectors == 0) { request->result = EIO; return; } immediately before the divisions, covering the (theoretical) case where the fallback param.sectors is also zero. The ata-queue caller (ata-queue.c:181,208,348,420) honors request->result and fails the I/O cleanly.

Supersedes the finding markdown's recommendation.

Phase-8 build validation

Combined kernel + modules build (DF-2068 / DF-2069 / DF-2070 / DF-2071 / DF-2072) on DragonFly 6.5-DEVELOPMENT #0 baseline:

• === NK_DONE rc=0 === (2026-07-25 11:31:20 UTC)
• 0 error: lines in the full 35,696-line build log
• ata-serverworks.c is part of the in-kernel nata driver; the patched TU compiled clean with the kernel's default -Wall ... -Wno-pointer-sign -Werror flags and linked into the kernel binary (ata_serverworks_tf_read / ata_serverworks_tf_write confirmed present via nm on kernel.debug).

The default kernel build IS a -Werror build; see fix_build.log and env.txt.

Reproduce

./build.sh    # rebuilds the patched kernel (rc=0 with -Werror)
./run.sh      # source-only confirmation; no runtime PoC (HW-gated)