# DF-1328 — mpr_user_event_report kernel-heap info leak

**Status:** INCONCLUSIVE (real bug; needs LSI SAS3+ HBA absent from audit guest)
**Impact:** info leak (kernel heap past recorded_events[40000], operator-group reachable)
**Driver:** `mpr` (LSI MPT-Fusion 3 SAS) — in `X86_64_GENERIC` but no HBA on guest

## Build & run
```
./build.sh        # cc -o poc poc.c -Wall
./run.sh          # ./poc   (as an operator-group user on an mpr-equipped host)
```
On the audit guest the PoC fails at `open("/dev/mpr0")` with `ENOENT`.
See `VERDICT.md` for the full trace and `fix.diff` for the validated patch.

## Files
- `poc.c`        — PoC (MPTIOCTL_EVENT_REPORT, Size=256KiB ≥ 40000)
- `VERDICT.md`   — full mechanism trace with path:line citations
- `fix.diff`     — copyout exactly sizeof(recorded_events), not user size
- `build.sh`/`run.sh`, `build.log`/`run.log`, `fix_build.log`, `env.txt`, `manifest.json`