DF-2414

Unvalidated 32-bit ccb_index read from firmware LRAM used to index ccb_infos[] in all four halt/error paths - OOB read NULL-deref and UAF

Summary

Four locations in advlib.c read u_int32_t ccb_index from RISC engine local RAM (firmware-shared memory) and use directly as array subscript into adv->ccb_infos[] (allocated with only max_openings<=240 entries) with zero bounds validation. (1) ADV_HALT_CHK_CONDITION :1005-1008 (2) ADV_HALT_SS_QUEUE_FULL :1046-1049 (3) SDTR negotiation adv_handle_extmsg_in :1893-1913 (4) adv_abort_ccb :1987-1988. AdvanSys twin of DF-2412/DF-2413 in advansys.c:1106 but in chip-halted interrupt handler reachable via CHECK_CONDITION QUEUE_FULL SDTR/WDTR extended-message halts all attacker-influenced via SCSI bus. Three corruption vectors: (a) firmware bugs write stale/wrong halt_qp (b) freed queue retains stale cinfo_index (c) adv_free_ccb_info sets ACCB_FREE but does NOT null cinfo->ccb dangling pointer UAF. Attacker: operator-group /dev/passN on system with AdvanSys HBA triggers CHECK_CONDITION etc via malicious device.

Discussion (0)

No comments yet.

Severity: Medium
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U:C:H/I:H/A:H
CWE: CWE-129 Improper Validation of Array Index
File: sys/dev/disk/advansys/advlib.c
Lines: 1005-1988
Area: dev
Discovered: 2026-07-28
Updated: 2026-07-28

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-08-09 13:46:47
Attempts: 2
Runtime: 4s
Code hash: n/a (no PoC sour
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: (no userspace PoC; HW-gated)
Run cmd: (no userspace PoC; HW-gated)

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: certain
Tested: 2026-08-09 13:46:48
Runtime: —
Kernel: X86_64_GENERIC built with batch fix.diffs (gcc 8.3, -Werror, build rc=0) — not booted; no target HW to exercise either kernel.
fix.diff: findings/poc/DF-2414/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2414 · 7 files

File	Type	Description	Size
VERDICT.md	verdict	HW-gate analysis + source trace + fix summary	1.9 KB	↓ raw
fix.diff	suggested-fix	git-apply-able defense-in-depth fix (applies + compiles)	2.4 KB	view raw
fix_build.log	build-log	combined build proof: all 18 fix.diffs compile in X86_64_GENERIC (-Werror, rc=0); each diff also passes git apply --check	404 B	view raw
manifest.json	manifest	this catalog	1.6 KB	view raw
env.txt	environment	guest uname + PCI/kldstat/dev inventory proving the gate	3.6 KB	view raw
build.sh	build-script	no-op (HW-gated, nothing to build)	356 B	view raw
run.sh	run-script	no-op (HW-gated, nothing to run)	268 B	view raw

VERDICT.md verdict HW-gate analysis + source trace + fix summary

↓ download raw

DF-2414 — Unvalidated 32-bit ccb_index from firmware LRAM used to index ccb_infos[] (OOB)

Verdict

NOT REPRODUCED (hardware / trigger gated). The cited vulnerable code path exists in sys/dev/disk/advansys/advlib.c and is compiled into the X86_64_GENERIC kernel, but it is not exercisable at runtime on this QEMU guest because the required HBA / device / trigger is absent. Confidence in the source bug itself: certain.

Why it cannot be reproduced here (the gate)

Hard-gated: needs an AdvanSys (adv) HBA. The guest has NO AdvanSys SCSI controller; adv_isr_chip_halted / adv_abort_ccb never run.

See env.txt for the full guest PCI/kldstat/dev-node inventory that proves the gate.

The bug is real in source (traced line-by-line)

Cited path: - sys/dev/disk/advansys/advlib.c:1005-1007 - sys/dev/disk/advansys/advlib.c:1046-1048 - sys/dev/disk/advansys/advlib.c:1893-1895 - sys/dev/disk/advansys/advlib.c:1987-1988 - The vulnerable construct is present verbatim in the current master source (confirmed by direct read of the cited lines during verification). - A defense-in-depth fix.diff that closes the path is included and was validated to apply (git apply --check) and to compile cleanly in a full X86_64_GENERIC kernel build with -Werror (build rc=0).

Fix

Bounds-check the firmware-supplied ccb index against adv->max_openings at all four consumption sites before indexing adv->ccb_infos[].

The standalone git-apply-able diff is fix.diff.

Reproduce

./build.sh && ./run.sh — both are no-ops on this guest by design (the gate holds). Exercising the path requires the corresponding HBA/device/trigger (ATA disk / ATAPI floppy or tape / NVMe controller / AdvanSys HBA / AHCI controller / a malicious ATAPI device / a CD burner / hot-unplug).

Status

status: not_reproduced | reproduced: 0 | impact: none (HW-gated) fix_status: not_testable (path cannot run on this guest; diff applies + compiles)

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not_testable: the vulnerable path is unreachable on this guest (no target HW/malicious device). Fix validated structurally: git apply --check OK + full kernel build rc=0 (-Werror).

git apply --check findings/poc/DF-2414/fix.diff -> OK. Combined kernel build: 'NK_DONE rc=0'. No runtime before/after possible (HW-gated).

↓ fix.diffX86_64_GENERIC built with batch fix.diffs (gcc 8.3, -Werror, build rc=0) — not booted; no target HW to exercise either kernel.

Confirmed kernel references

Detail

Exploit chain

none — valid hard blocker (driver/device path dead at runtime on this guest: no target HBA / no malicious device / no removable media). No unprivileged->root path.

Evidence (decisive lines)

kldstat -> kernel/ehci/xhci only (no target driver); pciconf -l -> PIIX3 IDE + virtio only (no AHCI/NVMe/AdvanSys HBA); camcontrol devlist -> only <QEMU QEMU DVD-ROM>; ls /dev/<target> -> No such file. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2414/{VERDICT.md,fix.diff,env.txt,build.sh,run.sh,manifest.json,fix_build.log}. No PoC source (HW-gated).

Verified recommended fix

Defense-in-depth fix.diff adds the validation/bounds check closing the cited path (see findings/poc/DF-2414/fix.diff; git apply --check OK).

Verdict

NOT REPRODUCED (HW/trigger-gated on this guest). The bug is REAL in source (traced line-by-line): advansys advlib unvalidated 32-bit ccb_index from firmware (no AdvanSys HBA). Gate confirmed via kldstat (target driver not loaded; only kernel+ehci+xhci), pciconf -l (no target HBA — only PIIX3 IDE atapci0 + virtio), camcontrol devlist (only QEMU DVD-ROM), and ls /dev (no target disk/tape/fd/nvme nodes). The benign QEMU devices cannot produce the malicious device responses the bugs require.