DF-4877 — afd_strategy(): no media-bounds check + 32-bit LBA truncation

sys/dev/disk/nata/atapi-fd.c:258, 277-280:

u_int32_t lba;
...
lba = bp->bio_offset / fdp->sectorsize;      /* u64 offset -> u32 lba */
...
ccb[2] = lba >> 24;  ccb[3] = lba >> 16;     /* 32-bit LBA in the CDB */
ccb[4] = lba >> 8;   ccb[5] = lba;

• No bounds check: afd_strategy() never compares bio_offset (or the transfer end) against fdp->mediasize. The raw-cdev path does not do it either: bounds_check_with_mediasize() (sys/kern/subr_disk.c:1458) is only used by device-mapper; a raw read/write on /dev/afd0 goes physio → afd_strategy with whatever offset the caller passes.
• 32-bit truncation: unlike ad_strategy() which keeps the LBA in a u_int64 (request->u.ata.lba, ata-disk.c), the afd driver narrows the block number to u_int32_t, and ATAPI_READ_BIG/WRITE_BIG carry only 32 LBA bits.

Net effect: any I/O at bio_offset ≥ 2^32 * sectorsize (2 TiB at 512B) — which must fail as out-of-range — silently wraps onto low LBAs. A write the caller intended for beyond-the-end (expecting EINVAL) instead lands at (offset/sectorsize) mod 2^32 — e.g. LBA 0..N, clobbering the start of the medium. Floppy-class media can never legitimately reach 2 TiB, so on an honest device every wrapped access is out-of-bounds by construction.

Threat model

The raw device already grants full-media read/write to its opener (typically root/operator), so this is not a privilege boundary crossing by itself; the security-relevant delta is silent misplacement of I/O that the kernel contractually must reject (correctness → data-integrity), matching the "geometry lie" class of DF-4798.

Status: untested (in situ) — requires an afd device

The audit guest has no ATAPI direct-access device (see DF-4874 pack, run.log), so the wrap cannot be demonstrated on-target. The trace is complete in source: no clamp before atapi-fd.c:258, and the CDB fields hold at most 32 bits (atapi-fd.c:277-280).

Fix

fix.diff: reject any bio that starts at/after mediasize or whose end passes it (EINVAL) before building the CDB — mirroring bounds_check_with_mediasize() semantics for the raw path.

DF-4877 VERDICT — afd_strategy missing bounds check + u32 LBA wrap

Status: untested in situ (hardware absent); established by line trace

Root cause

1. lba = bp->bio_offset / fdp->sectorsize; assigns a 64-bit byte offset (in sectors) into u_int32_t lba (sys/dev/disk/nata/atapi-fd.c:241, 258) — silent truncation.
2. Nothing between physio and the CDB build bounds-checks the I/O: - afd_strategy() has no mediasize comparison (whole function, atapi-fd.c:233-316); - the raw cdev path applies no disk-layer clamp — bounds_check_with_mediasize() exists (sys/kern/subr_disk.c:1458-1478) but its only caller is device-mapper (sys/dev/disk/dm/device-mapper.c:400); - contrast with ad_strategy() which at least keeps the LBA 64-bit (sys/dev/disk/nata/ata-disk.c:299).
3. The CDB carries 32 LBA bits (atapi-fd.c:277-280), so the wrap is not even detectable downstream.

Consequence

I/O that must be rejected as out-of-range instead targets (bio_offset/sectorsize) mod 2^32: silent wrong-block writes on the raw device. Not a privilege escalation (the raw device already grants the medium to its opener) — a kernel contract violation in the same "geometry/size lie" family as DF-4798.

Why untested

Requires an attached ATAPI direct-access device; the audit guest cannot emulate one (QEMU 7.2: no ATAPI floppy class — DF-4874/run.log records "afd0 device_t is NULL" from the loaded driver). Every element of the trace was verified in source instead.

Fix validation

fix_status: not_testable (same hardware blocker). fix.diff adds the explicit media-bounds rejection before the CDB build; semantics match bounds_check_with_mediasize() (reject past-EOF with EINVAL).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.