# PoC DF-1581: mfi_tbolt SMID off-by-one OOB index

**Class:** Heap OOB pointer deref
**Cited site:** `sys/dev/raid/mfi/mfi_tbolt.c:666,672,458-459`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/raid/mfi/mfi_tbolt.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

mfi_tbolt.c:666 if (!smid || smid > sc->mfi_max_fw_cmds + 1). Array mfi_cmd_pool_tbolt allocated mfi_max_fw_cmds entries (458-459). SMID range [1,mfi_max_fw_cmds] -> indices [0,mfi_max_fw_cmds-1]. SMID=mfi_max_fw_cmds+1 passes check, mfi_cmd_pool_tbolt[smid-1] reads 1 pointer past array (672). Triple deref: sync_cmd_idx (673), io_request->Function (680), cm_frame->dcmd.header.cmd_status (677).

## Realistic impact ceiling (on suitable HW)

kernel OOB pointer deref (panic or arbitrary kernel function call via firmware-controlled cb)

## Fix

Tighten the upper-bound check to smid > sc->mfi_max_fw_cmds (drop the +1 off-by-one).

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1581.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1581.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```