# DF-1172 — PoC evidence pack

**LSI v2 RAID parser OOB in `ata_raid_lsiv2_read_meta`
(`sys/dev/disk/nata/ata-raid.c:2799-2869`).**

`ata_raid_lsiv2_read_meta` indexes `raidp[array+meta->raid_number]`
(`ata_raid_arrays[16]`, BSS OOB write of a heap pointer for `raid_number>=16`),
`meta->configs[raid_number]` (`configs[30]`, OOB read for `raid_number>=30`),
and `raid->disks[meta->disk_number]` (`disks[16]`, heap OOB write for
`disk_number>=16`) — all three indices are `u_int8_t` (0..255) read straight
off the disk. nataraid sibling of DF-1171 (Intel parser).

## Status
REPRODUCED (primitive confirmed at source + harness). nataraid **is** in
`X86_64_GENERIC:83`; the live in-kernel trigger is blocked by the QEMU/loader
artifact (loader hangs on any extra hard disk, as in DF-1171).

## Reproduce (harness)
```
./build.sh harness   # cc -Wall -O2 -o overflow_harness overflow_harness.c
./run.sh harness     # prints the 3-site OOB math + fix check
```
Expected (harness, `raid_number=200, disk_number=200`):
- BUG 1: 16 BSS-OOB pointer stores, worst idx=215 → 1600 B into adjacent BSS
- BUG 2: `configs[200]` → OOB read (CWE-125)
- BUG 3: 240 OOB `ar_disk` entries × 48 B = 11520 B heap spill
- WITH FIX: all 0

`build_meta.py` / `crafted_lsiv2.img` is a reference crafted-disk artifact for
the (guest-blocked) live trigger.

## Fix
`fix.diff` rejects metadata whose `raid_number>=MAX_ARRAYS || disk_number>=MAX_DISKS`.
Validated: applies + compiles clean in a combined single-fix kernel
(`ata-raid.o`, `-Werror`); boots `#1`; the rejection-guard string is present in
the booted kernel. See `VERDICT.md` / `fix_validation.txt`.