# DF-1312 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unvalidated HBA-supplied index into srb[256] in itl/mv request callbacks

## Source Location
sys/dev/raid/hptiop/hptiop.c:336-532

## Verdict
Source-confirmed (complex fix): Unvalidated HBA-supplied index into srb[256] in itl/mv request callbac. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
hptiop_request_callback_itl at :339: srb=hba->srb[index&0x3FFFFFFF] (256 entries). :348: srb=hba->srb[index&0x7FFFFFFF]. hptiop_request_callback_mv at :532: srb=hba->srb[context>>16] (range 0-0xFFFF). No bounds check vs HPT_SRB_MAX_QUEUE_SIZE=256. Malicious/buggy HBA returns OOB index -> wild srb ptr -> deref srb->ccb/dma_map -> panic or code exec. mvfrey callback correctly masks &0xFF. Fix: validate masked index<256.