DF-2508 -- u32 overflow in afd_sense capabilities-path mediasize computation

Verification used the shared rig tree at /root/rigs on the audit guest (see manifest). The rig for this finding: dfv_afd (rig.c = harness, gen.sh = verbatim extractor, dfv_*_extract.h = generated production text). The decisive outputs below were captured live on the guest during the 2026-10-24 verification session; full session logs are summarized per run.

Build

sh build.sh            # extracts verbatim driver text + builds the KLD

Run (guest, root)

kldload ./dfv_rig.ko

kldload dfv_afd.ko; for i in 0 1 2; do sysctl kern.dfv_afd_run=$i >/dev/null; sysctl -n kern.dfv_afd_status; done

Expected

run.log: expected 0x7d81827e00 vs verbatim 0x81827e00 (exact low-32 truncation); fixed exact.

Fix validation

fix.diff casts the first operand to u_int64_t before the product; A/B exact.

Verdict: reproduced / impact=corruption (see verdict.json, VERDICT.md)

DF-2508 verdict -- u32 overflow in afd_sense capabilities-path mediasize computation

status: reproduced reproduced: 1 impact: corruption confidence: certain attempts: 1 runtime_sec: 500

The verbatim afd_sense capabilities-page path (atapi-fd.c:405-409) computes mediasize = be16toh(cylinders) * heads * sectors * sectorsize in 32-bit int arithmetic before the u_int64_t assignment (the sibling capacity paths at :384/:393 cast to u64 first). With drive-supplied geometry cyl=65535 heads=255 sectors=63 ss=512 the verbatim function computed mediasize=2172812800 (0x81827e00) where correct u64 math gives 539043724800 (0x7d81827e00) - exactly the low 32 bits; the second hostile geometry truncated 0x1fc0003fe00 -> 0x3fe00. The bogus size is published to the disk layer (partitioning/geometry corruption). Control geometry exact. Fixed source (u64 cast first) A/B: mediasize = 0x7d81827e00 exactly.

Evidence (decisive lines)

DF2508[1]: geometry cyl=65535 heads=255 sectors=63 ss=512 DF2508: expected mediasize (u64 math) = 539043724800 (0x7d81827e00) DF2508: verbatim afd_sense computed mediasize = 2172812800 (0x81827e00) DF2508: RESULT=WRAPPED (product evaluated in 32-bit int before the u64 assignment) DF2508[2]: expected 0x1fc0003fe00 -> verbatim 0x3fe00 --- control --- DF2508[0]: 1073741824 == 1073741824 clean --- fixed source A/B --- DF2508: verbatim afd_sense computed mediasize = 539043724800 (0x7d81827e00) ... RESULT=clean

Exploit chain / privesc assessment

logic/correctness (no memory safety): wrong media size from malicious/buggy ATAPI mode-sense data; corruption of on-disk assumptions.

Fix + A/B

fix.diff casts the first operand to u_int64_t before the product; A/B exact.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.