# VERDICT — DF-1278

## Status
**INCONCLUSIVE (source-confirmed; not runtime-triggerable on this guest).**

## Mechanism (source-confirmed)
`mpt_configure_ioc` at `sys/dev/disk/mpt/mpt.c:2623` is the per-controller
init routine. It retries failed init steps via three recursive self-calls:

| Site | Triggered when |
|------|----------------|
| `mpt.c:2645` | `mpt_reset()` fails |
| `mpt.c:2652` | `mpt_get_iocfacts()` fails |
| `mpt.c:2795` | `mpt_get_portfacts()` fails on any port |

All three pass `tn++` (C post-increment) as the argument. Post-increment
yields the *current* value of `tn` and only updates the local afterward, so
the recursion always forwards `tn == 0`. The retry-limit guard at
`mpt.c:2630` (`if (tn == MPT_MAX_TRYS) return (-1);`, with
`MPT_MAX_TRYS == 3` per `mpt.c:111`) therefore never fires.

A buggy or malicious LSI MPT/Fusion HBA that fails any of those three
sub-calls will recurse unbounded and overflow the kernel stack.

## Fix
Replace `tn++` with `tn + 1` at all three sites. The `tn` local then
correctly advances by one per retry, the guard fires after 3 attempts, and
the function returns `-1`.

## Verification on this guest
- `mpt` is statically compiled into `X86_64_GENERIC`
  (`sys/config/X86_64_GENERIC:93` — `device mpt`).
- `kldstat -v` confirms: `mpt_core`, `mpt_cam`, `pci/mpt`, `mpt_raid`,
  `mpt_user`.
- `pciconf -l` lists only `i440FX/PIIX3/PIIX4/virtio-net/virtio-blk/std-VGA`.
  No LSI MPT/Fusion PCI device is present, so `mpt_pci_probe` never matches,
  `mpt_attach` is never called, and `mpt_configure_ioc` never executes.
- The bug is therefore **not runtime-triggerable on this guest**.
- Fix validation: applied this `fix.diff` together with the four other
  driver fixes (DF-1279/1280/1285/1287) to a clean `with-src` snapshot,
  rebuilt `X86_64_GENERIC` with `make -j6 nativekernel`, build exited
  `rc=0`. Full build log: `combined_build.log`.

## Exploit chain
None. The primitive is kernel-stack-overflow panic via unbounded recursion,
reachable only at HBA attach time. No userspace trigger exists on this
guest.

## Realistic impact ceiling
Hardware-attacker DoS (PCIe / Thunderbolt / external chassis presenting a
malicious or faulty MPT/Fusion HBA). CVSS: `AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`.

## PoC changes
The PoC folder was empty; added `trigger_analysis.c` (documentation marker),
`build.sh`, `run.sh`, `README.md`, this `VERDICT.md`, `fix.diff`,
`manifest.json`, and the combined `combined_build.log`.

## Recommended fix
Matches the finding proposal: change `tn++` to `tn + 1` at `mpt.c:2645`,
`mpt.c:2652`, and `mpt.c:2795`. See `fix.diff`.

## Fix status
**not_testable** — the bug requires absent hardware. The `fix.diff` was
verified to apply (`patch -p1 --forward`) and compile cleanly into a
rebuild of `X86_64_GENERIC` together with four other fixes (combined build
`rc=0`).