# DF-1304 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
mlx_user_command DCDB fixup writes dcdb_physaddr past undersized heap buffer

## Source Location
sys/dev/raid/mlx/mlx.c:1872-1900

## Verdict
Source-confirmed (complex fix): mlx_user_command DCDB fixup writes dcdb_physaddr past undersized heap . No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
mlx_user_command at mlx.c:1898-1900: if(mc_mailbox[0]==MLX_CMD_DIRECT_CDB) dcdb=(struct mlx_dcdb*)kbuf; dcdb->dcdb_physaddr=... (4B at offset 4). kbuf=kmalloc(mu_datasize) at :1872. Only check mu_datasize<=MAXPHYS. sizeof(struct mlx_dcdb)=88 bytes. mu_datasize<8 -> dcdb_physaddr at kbuf+4 overflows. Root only (/dev/mlxN mode 0600). Fix: check mu_datasize>=sizeof(struct mlx_dcdb) when DCDB.