# DF-1311 — hptiop_post_req_itl stack buffer overflow

## Build
No standalone PoC binary — the trigger lives inside the kernel driver
(`sys/dev/raid/hptiop/hptiop.c`) and is only reachable on a host with a
HighPoint RocketRAID 3xxx HBA attached.  The deliverable is the **fix**:

```
./build.sh    # applies fix.diff and builds a single-fix GENERIC kernel
```

## Run
```
./run.sh      # attempts the trigger path; expected: NOT reachable on this guest
```

## Expected (bug present, on a host WITH the HBA)
A multi-segment SCSI transfer to a disk on a HighPoint RocketRAID 3xxx HBA
overflows the on-stack `struct hpt_iop_request_scsi_command` (`sg_list[1]`)
→ kernel stack corruption → panic or worse.

## On THIS guest (no HBA)
The driver is compiled into GENERIC but never attaches (no HighPoint PCI
device).  `./run.sh` documents the unreachable path and exits.  This is
**not_testable at runtime** on the QEMU guest; the fix is compile- and
boot-validated instead (see VERDICT.md, fix_build.log).

## Reproduce the FIX validation
1. `scp` `fix.diff` to the guest, `cd /usr/src && patch -p1 < fix.diff`
2. `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
3. Install `kernel.stripped` → `/boot/kernel/kernel`, reboot.
4. Confirm guest boots cleanly (no new hptiop-related issues) and `kern.version`
   bumps to the rebuilt build.