Unknown-INOT-status path overwrites the parsed notify entry with a log string and then acknowledges the string instead of the queue entry (f/w gets garbage ack; original Immediate Notify never properly acknowledged)
Summary
In the RQSTYPE_NOTIFY default case, ISP_SNPRINTF overwrites the just-parsed Immediate Notify entry in the 64-byte stack buffer with an ASCII log message; isp_print_bytes correctly prints the ORIGINAL entry (vptr) but isp_notify_ack(isp, local) is handed the STRING, which it re-parses as in_entry_t - na_iid/na_seqid/na_status/na_task_flags become ASCII bytes and that garbage Notify-Ack goes to the firmware queue. The original INOT is never acked - plausibly leaking the f/w INOT/ATIO resource count toward exhaustion under remote repetition (speculative, f/w-matching-dependent). Remote FC initiator on target-mode systems (custom kernel, options ISP_TARGET_MODE + role=tgt). One-token vptr fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4210 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 141 B | ↓ raw | |
| verdict.json | file | 1.0 KB | view raw |
DF-4210
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: see pass-2 result block fix
Fix verification
not_testablesee pass-2 result block fix
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; full path:line trace in pass-2 result block
Verdict
source-verified; hardware-gated (no ath NIC / no ISP_TARGET_MODE kernel on audit guest)
No comments yet.