# DF-1326 PoC: mpr_user_pass_thru stack buffer overflow

## Build
```
cc -O2 -Wall -o poc_mpr_stackoverflow poc_mpr_stackoverflow.c
```

## Run
```
./poc_mpr_stackoverflow /dev/mpr0
```

## Expected output
- Kernel panic with stack-protector violation (if compiled with -fstack-protector)
- OR kernel RCE if stack canary is absent (return address overwritten with 0x41414141...)
- OR page fault if the overwritten return address is unmapped

## Notes
- Requires /dev/mprN access (mode 0640 root:operator)
- The copyin at mpr_user.c:800 writes RequestSize bytes into 12-byte stack MPI2_REQUEST_HEADER
- The bounds check `if (data->RequestSize > sc->reqframesz)` at line 804 runs AFTER the overflow
- Any RequestSize > 12 overflows the stack frame