# PoC DF-1475: mprsas_add_device PhyNum off-by-one OOB write of targets[]

**Class:** heap OOB write (off-by-one)
**Cited site:** `sys/dev/raid/mpr/mpr_sas_lsi.c:885-897, 908`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — mpr(4) HW-gated as above. Trigger is a SAS device whose config_page.PhyNum == sassc->maxtargets.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/raid/mpr/mpr_sas_lsi.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 890 `(id = config_page.PhyNum) > sassc->maxtargets` uses strict greater-than, so PhyNum == maxtargets passes. targets[] has indices 0..maxtargets-1 (allocated sizeof(mprsas_target)*maxtargets at mpr_sas.c:761). Line 908 `targ = &sassc->targets[id];` with id==maxtargets writes one struct mprsas_target (~200 bytes) past the end of targets[].

## Realistic impact ceiling

corruption (DoS, latent privesc)

## Fix

Change `> sassc->maxtargets` to `>= sassc->maxtargets`.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1475.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1475.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/raid/mpr && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```