# DF-1278 — Infinite recursion in mpt_configure_ioc (tn++ post-increment)

## Finding
`mpt_configure_ioc` at `sys/dev/disk/mpt/mpt.c:2623` retries failed init
via three recursive self-calls at lines 2645, 2652, and 2795. All three pass
`tn++` as the recursive argument. C post-increment evaluates to the *current*
value of `tn` and only increments the local afterward, so the recursion always
forwards `tn == 0`. The retry-limit guard at line 2630
(`if (tn == MPT_MAX_TRYS /* == 3 */) return (-1);`) therefore never fires. A
buggy or malicious LSI MPT/Fusion HBA that fails any of `mpt_reset`,
`mpt_get_iocfacts`, or `mpt_get_portfacts` causes unbounded recursion that
overflows the kernel stack at attach / hot-plug time.

## Fix
Replace `tn++` with `tn + 1` at all three recursive call sites. The `tn`
local then correctly advances by one each retry, the guard at line 2630 fires
after 3 attempts, and the function returns `-1` instead of recursing forever.

## Verification on this guest
- The mpt driver is statically compiled into `X86_64_GENERIC`
  (`device mpt` in `sys/config/X86_64_GENERIC:93`) and shows up in
  `kldstat -v` (`pci/mpt`, `mpt_core`, …).
- The QEMU guest has **no LSI MPT/Fusion PCI device** (`pciconf -l` lists only
  i440FX/PIIX/ACPI/virtio-net/virtio-blk/std-VGA). The driver's
  `mpt_pci_probe` never matches, so `mpt_attach` -> `mpt_configure_ioc` is
  never called. The bug is therefore **not runtime-triggerable on this guest**.
- Source-level confirmation by reading the cited lines:
  - `mpt.c:2630` — the guard `if (tn == MPT_MAX_TRYS) return (-1);`.
  - `mpt.c:2645` — `return (mpt_configure_ioc(mpt, tn++, 1));` on failed reset.
  - `mpt.c:2652` — same on failed `mpt_get_iocfacts`.
  - `mpt.c:2795` — same on failed `mpt_get_portfacts`.
- Fix verified to compile by applying this `fix.diff` together with the four
  other driver fixes (DF-1279/1280/1285/1287) and rebuilding
  `X86_64_GENERIC` — `make -j6 nativekernel` succeeded.

## Realistic impact ceiling
Hardware-attacker (PCIe/Thunderbolt/external chassis) DoS: kernel stack
overflow panic. CVSS vector reflects `AV:P`. Not exploitable from an
unprivileged user without first presenting a malicious HBA.