# VERDICT — DF-1279

## Status
**INCONCLUSIVE (source-confirmed; not runtime-triggerable on this guest).**

## Mechanism (source-confirmed)
`mpt_configure_ioc` at `sys/dev/disk/mpt/mpt.c:2623` retrieves IOC facts at
line 2650-2654:

```c
if (mpt_get_iocfacts(mpt, &mpt->ioc_facts) != MPT_OK) { ... }
mpt2host_iocfacts_reply(&mpt->ioc_facts);
```

Then computes segment limits at line 2683:

```c
mpt->max_seg_cnt *= MPT_NRFM(mpt);
```

The macros (`mpt.h:876`, `mpt.h:882`):

```c
#define MPT_RQSL(mpt)        (mpt->ioc_facts.RequestFrameSize << 2)
#define MPT_NRFM(mpt)        (MPT_REQUEST_AREA / MPT_RQSL(mpt))
```

If a malicious or buggy IOC returns `IOCFACTS.RequestFrameSize == 0`, then
`MPT_RQSL(mpt) == 0` and `MPT_NRFM` divides `MPT_REQUEST_AREA` (512) by
zero. The CPU traps `#DE` and the kernel panics. There is no validation
between line 2654 and line 2683.

## Fix
Insert a guard immediately after `mpt2host_iocfacts_reply` (line 2654):
if `RequestFrameSize == 0`, log and return `EINVAL`. Real IOC firmware
always reports a non-zero frame size, so the guard only ever fires on a
broken or malicious device.

## Verification on this guest
- `mpt` is statically compiled into `X86_64_GENERIC`
  (`sys/config/X86_64_GENERIC:93` — `device mpt`).
- No LSI MPT/Fusion PCI device in `pciconf -l`, so `mpt_configure_ioc`
  never executes. **Not runtime-triggerable.**
- Fix validation: combined `X86_64_GENERIC` rebuild with this fix applied
  exited `rc=0`. Full log: `combined_build.log`.

## Exploit chain
None. The primitive is a `#DE` kernel panic at attach time; no userspace
trigger exists on this guest.

## Realistic impact ceiling
Hardware-attacker DoS (PCIe / Thunderbolt / external chassis). CVSS:
`AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`.

## PoC changes
Folder was empty; added `trigger_analysis.c`, `build.sh`, `run.sh`,
`README.md`, this `VERDICT.md`, `fix.diff`, `manifest.json`,
`combined_build.log`.

## Recommended fix
Matches the finding proposal: validate `mpt->ioc_facts.RequestFrameSize != 0`
immediately after `mpt2host_iocfacts_reply`, returning `EINVAL` if zero. See
`fix.diff`.

## Fix status
**not_testable** — bug requires absent hardware. `fix.diff` applies cleanly
and compiles into `X86_64_GENERIC` (combined build `rc=0`).