# DF-1313 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Ioctl copyin precedes bounds check vs HBA-controlled max_request_size + itl 8B copyout of 4B field

## Source Location
sys/dev/raid/hptiop/hptiop.c:1085-1377

## Verdict
Source-confirmed (complex fix): Ioctl copyin precedes bounds check vs HBA-controlled max_request_size . No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
hptiop_do_ioctl_mv/mvfrey at :1263/1359: copyin(lpInBuffer,req->buf,nInBufferSize) BEFORE size check at :1219/1301. Check compares nInBufferSize vs hba->max_request_size (HBA-reported) not actual ctlcfg DMA size (~1969B). Malicious HBA reports large request_size -> overflow of ctlcfg DMA block (mvfrey: corrupts inlist/outlist). itl lpBytesReturned copyout at :1195: sizeof(unsigned long)=8 from 4-byte bytes_returned field -> 4B info leak. Root only. Fix: move bounds check before copyin, use actua