# DF-1360 — mps_user_event_report kernel-heap info leak (mps)

## Summary
`mps_user_event_report` (`sys/dev/raid/mps/mps_user.c:1859`) `copyout`s
`size` bytes (uint32 user-controlled) out of the 10000-byte `recorded_events`
array. The guard at :1857 is a lower bound (`size >= 10000`), so any `size`
above 10000 over-reads the softc tail and adjacent heap. Twin of DF-1328 (mpr).
No SAS HBA on the audit guest → `/dev/mps0` absent.

## Reproduce
```
./build.sh   # cc -O2 -o poc poc.c
./run.sh     # ./poc
```
Expected on this guest: `poc: open /dev/mps0: No such file or directory
(errno=2)` and `RUN_EXIT=1` — the mps driver does not attach (no SAS HBA), so
the leak cannot be exercised here. On an mps-equipped host (root/operator) the
same PoC would leak kernel heap.

## Fix
`fix.diff` changes the copyout length to `sizeof(sc->recorded_events)`.
Validated to apply + compile (`mps.ko`, clean build rc=0).