# DF-1244 — mrsas_get_ld_list indexes ld_ids with unchecked firmware targetId (OOB byte write)

## Verdict
**SOURCE-CONFIRMED (real bug), INCONCLUSIVE at runtime** — the vulnerable code is compiled into the running GENERIC kernel (`device mrsas`), but the required LSI MegaRAID SAS controller is absent from the QEMU guest, so the code path is dormant and cannot be exercised. Fix authored and compile-validated.

## Mechanism (source trace)
`mrsas_get_ld_list()` issues the `MR_DCMD_LD_GET_LIST` DCMD to the firmware and walks the returned `MR_LD_LIST`:

- `sys/dev/raid/mrsas/mrsas.c:3385` — `ids = ld_list_mem->ldList[ld_index].ref.ld_context.targetId;`
  `targetId` is a `u_int8_t` (`sys/dev/raid/mrsas/mrsas.h:1397`), range 0–255, **firmware-controlled**.
- `sys/dev/raid/mrsas/mrsas.c:3386` — `sc->ld_ids[ids] = ...targetId;`
  `sc->ld_ids` is `u_int8_t[64]` (`MRSAS_MAX_LD = 64`, `sys/dev/raid/mrsas/mrsas.h:2418,1831`).
- The guard at line 3380 bounds the **loop count** (`ldCount <= MAX_LOGICAL_DRIVES`) but **never validates `targetId`**. A firmware response with `targetId >= 64` writes one byte past `ld_ids[]` into `ev_tq` (taskqueue pointer), `ev_task`, `CurLdCount`, `reset_flags`, `load_balance_info[]`, or `log_to_span[]` (`sys/dev/raid/mrsas/mrsas.h:2419-2424`).

Call sites: `mrsas_attach` (`mrsas.c:1734`) and `mrsas_aen_handler` on `MR_EVT_LD_CREATED`/`LD_DELETED` (`mrsas.c:3570,3575,3596`). Both require a mrsas device to be attached.

## Why not reproduced at runtime
- Guest PCI inventory: only `virtio` devices (vtblk0, vtnet0). No MegaRAID SAS controller ⇒ `mrsas_pci_probe` never matches ⇒ `mrsas_attach` never runs ⇒ `mrsas_get_ld_list` is dead code on this guest.
- The trigger is a **firmware-supplied** bad `targetId` (malicious/buggy controller or VFIO-passthrough device), not unprivileged-user input.
- This is a **driver-robustness / defense-in-depth** hardening gap: a misbehaving or emulated controller can OOB-write into the softc. The CAM layer caps `max_target = MRSAS_MAX_LD-1 = 63` for outgoing queries (`mrsas_cam.c:323`), but that does **not** constrain the incoming firmware DCMD response that populates `ld_ids`.

## Fix (fix.diff, compile-validated)
Validate `ids < MRSAS_MAX_LD` before indexing; log and skip out-of-range entries. The patched `mrsas.c` builds cleanly into `mrsas.ko` (88328 bytes) with gcc 8.3, `-Werror`.

## Realistic impact ceiling
Kernel heap/softc corruption from a malicious or buggy MegaRAID controller. On this guest: **not reachable** (no HW). Classify as Medium-severity hardening fix.