# DF-1358 — VERDICT

**REPRODUCED at the function level** (impact: `panic`).

## Mechanism

amr_quartz_get_work() at amr.c:2107 reads 'nstatus = sc->amr_mailbox->mb_nstatus' (u8, DMA-coherent). The local stack array 'u_int8_t completed[46]' is overflowed at :2112 'for (i=0; i<nstatus; i++) completed[i] = mb_completed[i];' when nstatus > 46 (overwriting saved RBP/RIP). The mbsave->mb_completed[46] write at :2123 overflows identically. amr_done at :1786 re-iterates mbox.mb_nstatus indexing mb_completed[] -> OOB read. A malicious or buggy HBA firmware (or DMA attack on the mailbox) can drive nstatus > 46.

## Why not live-reproduced on the QEMU guest

AMI MegaRAID hardware absent from QEMU guest. The amr module loads only on matching HW. Triggered from the interrupt-handler completion path.

## Recommended fix

In amr_quartz_get_work, after reading nstatus, clamp: 'if (nstatus > AMR_MSG_MAX_COMPLETIONS) nstatus = AMR_MSG_MAX_COMPLETIONS;'. Add #define AMR_MSG_MAX_COMPLETIONS 46 to amrreg.h and replace the magic-number 46 in completed[46] / mb_completed[46] with the named constant.

## Kernel references (confirmed during verification)

- sys/dev/raid/amr/amr.c:2095 (completed[46] stack array)
- sys/dev/raid/amr/amr.c:2107 (nstatus from DMA mb_nstatus)
- sys/dev/raid/amr/amr.c:2112-2114 (completed[i] = mb_completed[i] for i < nstatus)
- sys/dev/raid/amr/amr.c:2123-2124 (mbsave->mb_completed[i] write)
- sys/dev/raid/amr/amrreg.h:433/460 (mb_completed[46] in mailbox struct)

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`