# DF-1327 — mpr_user_pass_thru kernel-heap info leak

**Status:** INCONCLUSIVE (real bug; needs LSI SAS3+ HBA absent from audit guest)
**Impact:** info leak (kernel heap, operator-group reachable)
**Driver:** `mpr` (LSI MPT-Fusion 3 SAS) — in `X86_64_GENERIC` but no HBA on guest

## Build & run
```
./build.sh        # cc -o poc poc.c -Wall
./run.sh          # ./poc   (as an operator-group user on an mpr-equipped host)
```
On the audit guest the PoC fails at `open("/dev/mpr0")` with `ENOENT`
(no SAS HBA → driver never attaches → no device node).  See `VERDICT.md`
for the full source trace and `fix.diff` for the validated patch.

## Files
- `poc.c`        — PoC source (opens `/dev/mpr0`, MPTIOCTL_PASS_THRU, ReplySize=1MiB)
- `VERDICT.md`   — full mechanism trace with path:line citations
- `fix.diff`     — clamp both copyout sites to the real reply length `sz`
- `build.sh`/`run.sh` — exact repro commands
- `build.log`/`run.log` — guest build + run output
- `fix_build.log` — full nativekernel build with the fix applied (rc=0)
- `env.txt`      — guest environment + driver-availability facts
- `manifest.json`— machine-readable artifact catalog