# DF-1229 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
Untrusted diag BufferType used as fw_diag_buffer_list[3] index (OOB write into mpr_softc)

## Source Location
sys/dev/raid/mpr/mpr.c:2388-2399

## Verdict
Source-confirmed: Untrusted diag BufferType used as fw_diag_buffer_list[3] index (OOB wr. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
mpr_intr_locked() at mpr.c:2388-2399: Diag release reply BufferType is firmware u8 (0-255), fw_diag_buffer_list has MPI2_DIAG_BUF_TYPE_COUNT=3 entries. pBuffer=&sc->fw_diag_buffer_list[rel_rep->BufferType] with NO bounds check. BufferType>=3 -> OOB write into mpr_softc fields (events_to_record, recorded_events, eedp_enabled, control_TLR). Three single-byte assignments. Malicious/buggy HBA. Fix: range-check BufferType<MPI2_DIAG_BUF_TYPE_COUNT.