DF-2274 — scsi_da.c divide-by-zero from device-supplied block size of zero

Verdict: NOT REPRODUCED (hardware-gated) — source bug CONFIRMED real; fix.diff compiles.

Classification: not_reproduced / HW-gated / impact=none. The div-by-zero is real in source; the defense-in-depth fix.diff compiles cleanly (nativekernel rc=0, -Werror, -DINVARIANTS).

Why not reproduced (the gate)

The bug is in the da(4) direct-access disk peripheral (dasetgeom + XPT_CALC_GEOMETRY). The guest has no da(4) target: the only disk is the virtio-blk root device (vtblk0, not SCSI/CAM), and camcontrol devlist shows only the QEMU DVD-ROM. There is no /dev/da* node. The trigger additionally requires a malicious SCSI/USB disk returning READ CAPACITY with length == 0. The unprivileged actor maxx cannot reach any da(4) path.

Gate proof (this guest):

$ camcontrol devlist   ->  only QEMU DVD-ROM (cd0); no da target
$ ls /dev/da*          ->  No such file or directory
$ pciconf -l | grep mass-storage  ->  atapci0 (PIIX3 IDE), virtio_pci1 (vtblk root disk)
$ id maxx              ->  uid=1001(maxx) ... groups=1001(maxx)

The source bug (real, cited path:line)

sys/bus/cam/scsi/scsi_da.c: - READ CAPACITY parse: block_size = scsi_4btoul(rdcap->length) (scsi_da.c:1831, also :1850 long form) — device-controlled, no validation. - dasetgeom(periph, block_size, maxsector) (:1853, :2270) stores it verbatim: dp->secsize = block_len (:2289), ccg->block_size = dp->secsize (:2302). - Every subsequent I/O divides by secsize: TRIM merge (:1341-1342, :1366), KKASSERT(bio->bio_offset % secsize == 0) (:1490), read/write LBA math (:1500-1501), and the SIM's XPT_CALC_GEOMETRY handler. secsize == 0 → #DE → trap_fatal → kernel panic. - A second path: when READ CAPACITY fails with a non-0x25 sense, dasetgeom is never called, so secsize stays at its M_ZERO initial 0, again dividing by zero on the next I/O.

Note (upstream mitigation observed during tracing): the XPT core xpt_action() XPT_CALC_GEOMETRY dispatcher at sys/bus/cam/cam_xpt.c:3063 already filters block_size == 0 (and volume_size == 0) before calling the SIM, so the SIM-side XPT_CALC_GEOMETRY div-by-zero variants in the HBA drivers (DF-2411/2415) are not reachable via the da→dasetgeom→xpt_action path on this kernel. The da driver itself, however, still caches secsize == 0 and divides by it in its own strategy/trim paths, so the panic remains reachable from a malicious device.

Attacker model: malicious SCSI/USB disk (evil-maid auto-probe on plug-in, or iSCSI target with crafted READ CAPACITY). No user account required for the auto-probe path.

Exploit chain

Not developed — no da(4) target on this guest and no malicious disk. Valid hard blocker: device-controlled primitive, no malicious device present.

Fix (defense-in-depth, validated to compile)

fix.diff makes dasetgeom() reject block_len == 0 (returning EINVAL) before caching it as secsize, converting the signature to int so callers can propagate the failure. Validated in the combined nativekernel build (fix_build.log).

Reproduce

No runnable PoC on this guest (no da target, no malicious disk). Artifacts: env.txt, fix.diff, fix_build.log.