# DF-1228 — README

## Finding

`mpr_intr_locked()` in `sys/dev/raid/mpr/mpr.c` uses the HBA-supplied
`SMID` directly as an index into `sc->commands[]` at lines **2336** and
**2407-2408**, with no bounds check. `SMID` is a `U16` (0..65535);
`sc->commands[]` is sized `sc->num_reqs` (typically a few thousand).
A malicious/buggy HBA returning `SMID >= num_reqs` causes an out-of-bounds
pointer; subsequent `cm->cm_state` / `cm->cm_reply` writes are OOB writes,
and `mpr_complete_command()` eventually calls `cm->cm_complete(sc, cm)` —
a hijackable control-flow transfer from heap residue on INVARIANTS-OFF
kernels.

## Verdict

**NOT REPRODUCED** on this guest (latent): the audit guest has no LSI
MPT-Fusion 3 controller in `pciconf -lv`, so the interrupt handler never
runs. The driver **is** statically linked into `X86_64_GENERIC`
(`kldstat -v` shows `pci/mpr`), so the bug path is in the running kernel
and is exercised on real DragonFly installs that have the matching HBA.

**Confidence (bug is real):** certain — traced line-by-line in `sys/`.
**Impact ceiling:** kernel heap OOB read/write + control-flow hijack by a
malicious/buggy PCIe HBA. **Not** an unprivileged-user-to-root vector.

## How to reproduce

```
./build.sh && ./run.sh
```

Expected on this guest: PoC builds clean, prints "No /dev/mprN found: No
such file or directory" and the reachability analysis. On a host with an
`mpr` HBA plus a malicious/buggy firmware, an interrupt with `SMID >=
num_reqs` triggers the OOB index.

## Files

| Path                  | Purpose                                                   |
|-----------------------|-----------------------------------------------------------|
| `mpr_smid_oob.c`      | PoC: reachability check + explains the trigger             |
| `build.sh` / `run.sh` | exact build/run commands                                  |
| `fix.diff`            | SMID bounds check in both branches of `mpr_intr_locked`   |
| `VERDICT.md`          | full path:line trace, threat model, fix rationale         |
| `build.log`           | full cc output of the PoC build                           |
| `run.log`             | full output of the PoC run on this guest                  |
| `fix_build.log`       | kernel-build compile validation of fix.diff               |
| `env.txt`             | guest uname / cc / device topology                        |