I've definitely heard about attacks from malicious peripherals abusing DMA - apparently it was particularly easy with firewire. I don't know any more details.
I think to have any prayer of pulling this off for SATA or PCIe, though, you should be using a much beefier microcontroller than an Arduino. I'd be looking at a decently fast 32-bit ARM-based micro, at least - maybe even something RasPi-tier....