DF-2508
u32 integer overflow in afd_sense capabilities-path mediasize calculation
Summary
Capabilities-page path of afd_sense computes mediasize as product of four u32-or-smaller operands evaluated in u32 arithmetic before assignment to u64 mediasize field. For large geometry intermediate product wraps mod 2^32 yielding incorrect truncated media size. Sibling capacity path at :384 correctly casts to u64 first. Attacker-influenced ATAPI mode-sense data. Impact: incorrect disk geometry/size reporting to disk framework partitioning data-corruption surprises. Logic/correctness rather than memory safety.
No comments yet.