# DF-1370 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unchecked chip-controlled EventDataLength passed to hexdump reads past reply frame

## Source Location
sys/dev/raid/mps/mps.c:1269-1267

## Verdict
Source-confirmed: Unchecked chip-controlled EventDataLength passed to hexdump reads past. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
mps_log_evt_handler at mps.c:1269: hexdump(event->EventData,event->EventDataLength,NULL,0). EventDataLength U16 from DMA reply. No bound vs reply frame size (~96-128 bytes). Length=0xFFFF -> reads 65KB past frame. Kernel heap info leak to console or panic. Sibling of DF-1281 (mpt EventDataLength). Malicious/buggy HBA. Fix: clamp length to ReplyFrameSize*4-offsetof(EventData).