Out-of-bounds reads and a write in libiscsi SCSI data-in unmarshalling

Seven memory-safety bugs in the SCSI data-in unmarshalling layer (lib/scsi-lowlevel.c), all reachable from a malicious iSCSI target’s reply (INQUIRY / REPORT LUNS are issued early against any target the client connects to). One root cause: reading or sizing from task->datain.data without gating on task->datain.size. The scalar reads in the same functions already use the bounds-checked task_get_* accessors; these raw paths skip them.

• OOB WRITE — REPORT LUNS (scsi_reportluns_datain_unmarshall, :590, CWE-787). list_size < 8 makes num_luns = list_size/8 - 1 = -1; the alloc wraps to 2 bytes, then list->num = num_luns writes 4 bytes into it. Reject num_luns < 0 before the alloc. (Distinct from the #385 discussion of the list_size < datain.size check at :493 — this is a missing lower bound.)
• OOB READ — standard INQUIRY (scsi_inquiry_unmarshall_standard, :1577/:1579/:1581, CWE-125). Raw memcpy of vendor/product/revision from fixed offsets; a < 36-byte reply reads past the buffer. Gate on datain.size >= 36.
• OOB READ — INQUIRY VPD decoders ×3 (CWE-125): page 0x00 supported_pages (:1612), page 0x80 unit_serial_number (:1632), page 0x83 device_identification (:1663, a raw dptr walked dptr += 4 + dptr[3] past the buffer — worst of the three). Clamp each copy to datain.size - offset and bound the walk.
• OOB READ — INQUIRY Third-Party Copy VPD (page 0x8F) (scsi_inquiry_unmarshall_third_party_copy, :1763, CWE-125). remaining drives a while over raw dptr with in-band lengths and no bound; a type-0x0001 descriptor recurses into third_party_copy_unmarshall_supported_commands (:1707), walking a second raw pointer — same class one level down.
• OOB READ — MAINTENANCE IN / REPORT SUPPORTED OP CODES (scsi_maintenancein_datain_unmarshall, :1343, CWE-125). The guard checks only cdb_length <= sizeof(cdb_usage_data), not 4 + cdb_length <= datain.size.

All ASan-confirmed with standalone repros and per-bug fixes. The full bundle (seven cases) was reported privately to the maintainer, Ronnie Sahlberg, on 2026-07-21. He fixed them in commit eff2822fd (“fix several vulnerabilities parsing data-in”) on 2026-08-03. Rebuilding libiscsi at the fix commit and replaying every repro confirms each parses cleanly under ASan/UBSan, with no regression on the seed corpus.