# DF-1120 — Buddy allocator unbounded merge OOB write in ___sym_mfree (SCSI sym)

## Finding
`___sym_mfree` at `sys/dev/disk/sym/sym_hipd.c:476-497` has a merge loop
whose index `i` climbs without bound. The `h[]` array is declared at
`:408` as `h[MEMO_CLUSTER_SHIFT - MEMO_SHIFT + 1]` = `h[9]` on x86_64
(indices 0–8). The `MEMO_FREE_UNUSED` guard at `:477` is wrapped in
`#if 0 ... #endif` at `:366-368`, so it does NOT compile in. When two
buddy-adjacent 4096-byte (`MEMO_CLUSTER_SIZE`) allocations are freed, the
merge succeeds at `i=8` (`s` becomes 8192), and the next loop top does
`q = &h[9]` → 8-byte OOB write past `m_pool_s.h[]` into adjacent kernel
heap.

## Reachability on this guest
**NOT reachable.** No SCSI sym HBA is present (`pciconf -lv` shows only
virtio devices + PIIX3). `sym.ko` is loadable but never attaches. The
bug is a latent heap-corruption primitive.

A userspace harness replicates the allocator bookkeeping with the same
layout and demonstrates the OOB write into a canary.

## Build / Run / Expected
```
cc -O2 -o harness harness.c     # build.sh
./harness                        # run.sh
# Expected: "*** OOB WRITE at h[9] -- canary corrupted ***"
```

## Files
- `harness.c` — allocator bookkeeping replica demonstrating the OOB at h[9].
- `fix.diff` — adds `if (s >= MEMO_CLUSTER_SIZE) break;` unconditional guard
  at the top of the merge loop.
- `build.log` / `run.log` / `env.txt` — captured outputs.