# DF-1281 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unbounded EventDataLength loop in mpt_core_event reads past reply frame leaking kernel memory to console

## Source Location
sys/dev/disk/mpt/mpt.c:559-673

## Verdict
Source-confirmed: Unbounded EventDataLength loop in mpt_core_event reads past reply fram. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
mpt_core_event at mpt.c:672-673: for(i=0;i<msg->EventDataLength;i++) mpt_prtc(mpt,%08x,msg->Data[i]). EventDataLength is u16 from IOC event reply, no upper bound. Data[] flexible array at offset 0x1C in 256B frame. EventDataLength>57 -> reads past frame slot; >2041 -> past 8192B reply buffer into kernel heap. Printed to console via mpt_prtc. Malicious HBA posts MPI_EVENT_LOG_DATA with EventDataLength=2000. Fix: cap i at (MPT_REPLY_SIZE-offsetof(...,Data))/4.