# PoC DF-1474: mprsas_fw_work iterates event PHY/Element arrays past allocation

**Class:** heap OOB read (firmware-controlled count)
**Cited site:** `sys/dev/raid/mpr/mpr_sas_lsi.c:216, 294`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — mpr(4) is in GENERIC but only attaches to LSI SAS3 HBAs (PCI ID 1000:0097 etc.). No HW in the audit guest; trigger is a malicious/emulated SAS3 HBA emitting crafted event replies.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/raid/mpr/mpr_sas_lsi.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Lines 211-241 (SAS_TOPOLOGY_CHANGE_LIST) and 284-… (IR_CONFIGURATION_CHANGE_LIST) loop `i < data->NumEntries` / `i < event_data->NumElements`, where NumEntries/NumElements are u8/u32 read from inside the event buffer. The PHY[1]/ConfigElement[1] declarations are flexible-array trailers; the actual allocation is `EventDataLength*4` bytes (mpr_sas_lsi.c:148-149). Firmware-supplied NumEntries/NumElements > what fits in the allocation drives OOB heap reads of the event_data buffer.

## Realistic impact ceiling

leak/corruption (DoS, info leak)

## Fix

Track event_data_sz in mpr_fw_event_work; bound both loops by `(i+1)*sizeof(entry) <= event_data_sz`.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1474.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1474.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/raid/mpr && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```