# PoC DF-1530: hptmv gui_lib.c HPT_IOCTL_GET_CHANNEL_INFO OOB bus index

**Class:** Wild pointer deref / OOB read
**Cited site:** `sys/dev/raid/hptmv/gui_lib.c:1164-1179, 469-472`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/raid/hptmv/gui_lib.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

HPT_IOCTL_GET_CHANNEL_INFO reads bus = ((DWORD*)lpInBuffer)[1] with NO range check vs MV_SATA_CHANNELS_NUM. hpt_get_channel_info at 469-472 reads pAdapTemp->mvChannel[bus].online (MV_CHANNEL[4 or 8]) and VDevices[bus] (_VDevice[4 or 8]). Signed int from DWORD: 0x80000000 -> negative -> wild pointer deref. Small positive bus > channels: OOB read.

## Realistic impact ceiling (on suitable HW)

kernel OOB read / wild pointer panic; potential kernel pointer leak via VDEV_TO_ID truncation

## Fix

Reject bus >= MV_SATA_CHANNELS_NUM in the HPT_IOCTL_GET_CHANNEL_INFO case (the value is signed, so the unsigned compare catches negatives too).

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1530.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1530.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```