DF-2421 VERDICT — raw csio->data_ptr dereference via CAM_DIR_NONE CCBs

Bottom line

REPRODUCED on live AHCI hardware: operator-privileged arbitrary kernel address write (zeros + synthetic-response bytes), silent, repeatable, plus NULL-deref / chosen-address panic variants. Every code claim of the finding verified line-for-line and exercised at runtime.

Mechanism (verified in source, then live)

1. A userland XPT_SCSI_IO submitted through /dev/passN is merged wholesale into the kernel CCB by xpt_merge_ccb (cam_xpt.c:3888-3900 — flags and the whole csio payload including data_ptr are copied from the user).
2. passsendccb (scsi_pass.c:565-568) invokes cam_periph_mapmem ONLY when (flags & CAM_DIR_MASK) != CAM_DIR_NONE for XPT_SCSI_IO; with CAM_DIR_NONE no mapping/validation happens (cam_periph.c:677 returns 0 immediately). csio->data_ptr keeps the raw user-supplied value.
3. ahci_xpt_scsi_disk_io (ahci_cam.c:1083) takes rdata = csio->data_ptr and the synthetic handlers write it unconditionally: INQUIRY bzero(rdata, rdata_len) + field writes (:1109-1126), READ_CAPACITY/READ_CAPACITY_16 (:1159-1180), and EVPD page-inquiry (bzero(ccb->csio.data_ptr, dxfer_len) + bcopy at :1693-1694). No CAM_DIR check exists anywhere in the file.

Live evidence (run.log, panic-null.txt, panic-addr.txt)

• Surgical non-fatal writes with userland readback oracle (kernel symtab present, no KASLR):
• hostname (kernel bss, 0xffffffff81193360): one INQUIRY CCB with data_ptr=hostname+8, dxfer_len=36 → kern.hostname truncated from 64 chars to exactly 8 (zeroed [8..43], INQUIRY byte0 = T_DIRECT = 0 terminates). CCB returned CAM_REQ_CMP — silent.
• version (kernel .data): version+64..+99 zeroed → sysctl kern.version truncated exactly at +64.
• EVPD page 0x80 (page_inquiry path): hostname+40 → exactly 40 chars + NUL.
• READ_CAPACITY (bzero + capacity/512 fields): hostname+16 → 16 chars.
• NULL deref: data_ptr=NULL → Fatal trap 12, fault VA 0x0, supervisor WRITE, Stopped at memset+0x2b (bzero(rdata,...)).
• Chosen kernel VA: data_ptr=0xfffff800deadf000 → trap 0xc at the same memset+0x2b write instruction (kernel faults the raw pointer, panicking in vm_object_hold_shared).

Threat model / escalation notes

/dev/passN is 0600 root:operator — matches the finding's "operator-privileged" premise (also: any root context). The write gives full control of WHERE and LENGTH (dxfer_len up to 2^16 bytes for READ_CAPACITY paths; INQUIRY caps at sizeof(inquiry_data)); content = zeros + fixed header fields + disk-IDENTIFY-derived strings (model/serial — attacker-influenced with physical/easily-swapped media; on emulated disks fully chosen). uid=0 escalation was NOT completed in this run: the primitive is write-only (no read oracle from the same interface to locate dynamic targets such as a process ucred), and content control beyond the identify strings is limited. The demonstrated surgical corruption of live kernel .data/.bss at arbitrary addresses is the finding's claim verbatim.

Fix validation (see fix section in README / fix.diff)

Patched kernel (fix.diff: reject CAM_DIR_NONE with dxfer_len > 0 in both IO dispatchers) re-built and booted in the guest: * inquiry-null / inquiry-addr / surgical: no panic, no corruption — CCB returns CAM_REQ_INVALID (ioctl error), hostname and kern.version unchanged. * normal I/O (da0 reads, pass read10, TEST_UNIT_READY with dxfer_len=0) unaffected.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.