# DF-1224 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Heap over-read in INQUIRY VPD page 0x00 TLR scan: loop bound ignores 4-byte VPD header

## Source Location
sys/dev/raid/mpr/mpr_sas.c:2766-2774

## Verdict
Source-confirmed: Heap over-read in INQUIRY VPD page 0x00 TLR scan: loop bound ignores 4. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
mprsas_scsiio_complete TLR scan at mpr_sas.c:2771-2774: loop for(i=0;i<MIN(vpd_list->length,alloc_len);i++) reads list[i] at buffer offset 4+i. Buffer is sizeof(scsi_vpd_supported_page_list)=255B. length is u8 from device (0-255). alloc_len from CDB - resid, resid never set on SUCCESS path so alloc_len=255. length=255 -> reads data_ptr[4..258] -> 4 bytes past 255B buffer. Also alloc_len-=resid is unchecked u16 subtraction (underflow when resid>alloc_len). Malicious sequential-access SSP target.