# DF-1425 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unchecked HBA-controlled msg_len in screen-service writes NUL byte at arbitrary scratch offset

## Source Location
sys/dev/raid/iir/iir.c:1717-1725

## Verdict
Source-confirmed: Unchecked HBA-controlled msg_len in screen-service writes NUL byte at . Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
gdt_sync_event at iir.c:1720-1725: msg_len from HBA DMA gc_scratch[GDT_SCR_MSG_LEN] (u32). gc_scratch[GDT_SCR_MSG_TEXT+msg_len]=0 with no bound vs GDT_SCRATCH_SZ. msg_len>3056 -> NUL write past scratch into adjacent kernel heap. Also kprintf over-reads if text is NUL-free. Malicious/buggy HBA DMA. Fix: clamp msg_len to GDT_SCRATCH_SZ-GDT_SCR_MSG_TEXT-1.