# DF-1230 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
mpr_dispatch_event isset() OOB read when firmware supplies Event >= 128

## Source Location
sys/dev/raid/mpr/mpr.c:2458-2460

## Verdict
Source-confirmed: mpr_dispatch_event isset() OOB read when firmware supplies Event >= 12. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
mpr_dispatch_event() at mpr.c:2458-2460: event=le16toh(reply->Event) u16 (0-65535), then isset(eh->mask,event). eh->mask is uint8_t[16] (mprvar.h:266) so valid events 0-127. event>=128 -> isset reads eh->mask[event/8] OOB up to 8KB past mask. OOB byte controls whether callback function pointer is invoked. Malicious/buggy HBA. Fix: check event < sizeof(eh->mask)*NBBY before isset.