# PoC DF-1449: mpt_raid.c unvalidated firmware indices → OOB read/write of RAID arrays

**Class:** heap-OOB (firmware-controlled indices)
**Cited site:** `sys/dev/disk/mpt/mpt_raid.c:414, 1155, 1309, 1405, 1436`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — mpt(4) is in GENERIC but requires an LSI Fusion HBA. No HW in the audit guest; trigger is a malicious/faulty HBA sending crafted IOC pages or RAID events.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/disk/mpt/mpt_raid.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

`raid_disks[]` and `raid_volumes[]` are kmalloc'd with `ioc_page2->MaxPhysDisks` / `MaxVolumes` entries (mpt.c:2019,1990). Firmware-supplied indices index them with NO bounds check: raid_event->PhysDiskNum at mpt_raid.c:414; vol_pg->PhysDisk[i].PhysDiskNum at 1155/1309; ioc_disk->PhysDiskNum at 1405; ioc_vol->VolumePageNumber at 1436. A malicious HBA returning PhysDiskNum/VolumePageNumber >= MaxPhysDisks/MaxVolumes corrupts adjacent slab memory. The for-loops bounded by NumPhysDisks/NumActiveVolumes iterate based on firmware counts without validation against the allocation.

## Realistic impact ceiling

corruption (DoS, latent privesc)

## Fix

Add `PhysDiskNum < raid_max_disks` / `VolumePageNumber < raid_max_volumes` bounds checks at each of the 5 OOB sites; skip-and-log on out-of-range.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1449.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1449.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/disk/mpt && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```