HW-gated SCSI/FC HBA driver finding

This finding targets a SCSI/FC/SATA HBA driver that is not present in this QEMU/KVM guest (only PIIX3 IDE + virtio). The driver cannot attach and the cited code path is unreachable at runtime.

Reproduction status: NOT REPRODUCED (HW-gated)

• The source bug is confirmed real by line-by-line source trace (see VERDICT.md).
• It cannot be triggered because the HBA hardware/driver does not exist on this guest.
• A defense-in-depth fix.diff has been authored and validated with git apply --check.

Evidence

• VERDICT.md — full source trace and analysis
• env.txt — guest environment (kldstat, pciconf, camcontrol gate proof)
• fix.diff — git-apply-able defense-in-depth fix
• manifest.json — machine-readable catalog

DF-2469 — Heap OOB write via double channel offset in RQCS_SYNCXFER_FAILED

Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

Hardware gate

No QLogic ISP (FC/SCSI) HBA is present in this QEMU/KVM guest: - kldstat: only kernel, ehci.ko, xhci.ko — no isp.ko module loaded - pciconf -l: only PIIX3 IDE (atapci0), virtio-net, virtio-blk — no QLogic PCI device - camcontrol devlist: only QEMU DVD-ROM

The isp driver cannot attach, so the cited code path (isp.c RQCS_SYNCXFER_FAILED handler) is never reached at runtime. This is a latent source bug that can only fire on real (or emulated) QLogic ISP1080/1240/1280/12160 dual-bus hardware.

Source trace (confirmed real bug)

File: sys/dev/disk/isp/isp.c:6282-6283

case RQCS_SYNCXFER_FAILED:
    ...
    if (IS_SCSI(isp)) {
        sdparam *sdp = SDPARAM(isp, XS_CHANNEL(xs));  // line 6282: indexes by channel
        sdp += XS_CHANNEL(xs);                          // line 6283: double-applies channel offset ← BUG
        sdp->isp_devparam[XS_TGT(xs)].goal_flags &= ~DPARM_SYNC;

The sibling handler RQCS_WIDE_FAILED at lines 6266-6273 uses the same pattern but without the erroneous sdp += XS_CHANNEL(xs) line — confirming the extra line at 6283 is a bug, not intentional. For a dual-bus card (isp_nchan=2), isp_param has 2 sdparam entries. SDPARAM(isp, 1) returns &isp_param[1], then sdp += 1 moves to &isp_param[2] — one past the end — and the subsequent 16-bit read-modify-write corrupts adjacent heap.

Fix

Removed the erroneous sdp += XS_CHANNEL(xs); line. See fix.diff.

Impact (on HW that has the HBA)

Medium — heap OOB write of ~8 bytes (goal_flags RMW) at a controlled offset (~256 bytes range via XS_TGT). Requires a dual-bus ISP SCSI adapter with an active command completing with SDTR failure on channel 1.