HW-gated SCSI/FC HBA driver finding

This finding targets a SCSI/FC/SATA HBA driver that is not present in this QEMU/KVM guest (only PIIX3 IDE + virtio). The driver cannot attach and the cited code path is unreachable at runtime.

Reproduction status: NOT REPRODUCED (HW-gated)

• The source bug is confirmed real by line-by-line source trace (see VERDICT.md).
• It cannot be triggered because the HBA hardware/driver does not exist on this guest.
• A defense-in-depth fix.diff has been authored and validated with git apply --check.

Evidence

• VERDICT.md — full source trace and analysis
• env.txt — guest environment (kldstat, pciconf, camcontrol gate proof)
• fix.diff — git-apply-able defense-in-depth fix
• manifest.json — machine-readable catalog

DF-2520 — trm_ExecuteSRB writes user-controlled nseg SG entries into 32-slot pSRBSGL

Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

Hardware gate

No Tekram DC395 SCSI HBA in guest: kldstat shows only kernel/ehci/xhci; pciconf -l shows no Tekram PCI device. The trm driver does not attach.

Source trace (confirmed real bug)

File: sys/dev/disk/trm/trm.c:433-440 (trm_ExecuteSRB)

psg = pSRB->pSRBSGL;           // DMA-coherent region: TRM_MAX_SG_LISTENTRY(32) * sizeof(SGentry)
while (dm_segs < end_seg) {
    psg->address = dm_segs->ds_addr;
    psg->length = (u_long)dm_segs->ds_len;
    psg++;
    dm_segs++;
}

pSRBSGL is allocated as TRM_MAX_SG_LISTENTRY * sizeof(SGentry) = 32 * 8 = 256 bytes (trm.h:92, 3498). The DMA tag buffer_dmat allows TRM_NSEG segments (btoc(MAXPHYS)+1, typically 33). If nseg > 32, the loop writes past the 32-entry SG list into adjacent SRB SG lists / kernel heap. There is no bounds check on nseg before the loop.

Fix

Added if (nseg > TRM_MAX_SG_LISTENTRY) early-return check before the SG fill loop. See fix.diff.

Impact (on HW that has the HBA)

High — heap overflow via pass(4) SCATTER_VALID with sglist_cnt > 32. Operator-group /dev/passN access suffices.