# DF-1851 PoC

Trigger: write a crafted `HPT_IOCTL_PARAM` to sysctl `hptmv.status`
where `nInBufferSize + nOutBufferSize` wraps in 32-bit unsigned to a
value <= PAGE_SIZE, bypassing the size check. `kmalloc` allocates the
wrapped (small) size; `copyin` copies the original (huge) `nInBufferSize`
bytes, overflowing the slab.

## Preconditions

* `device hptmv` loaded (sysctl is always registered whether or not
  hardware is present).
* Root (`SYSCAP_NOSYSCTL_WR`).

## Build

```
cc -o poc_hptmv_heapoverflow poc_hptmv_heapoverflow.c
```

## Run

```
sudo ./poc_hptmv_heapoverflow
```

## Expected output

```
kernel: page fault trap, code=0
panic: vm_fault: ... (corrupted slab freelist metadata)
```

## Fix

See the finding markdown: bound each size individually before the sum
and cast to `size_t` to prevent 32-bit wraparound. Also add `M_ZERO` to
`kmalloc` (DF-1852) and check `copyin` return (DF-1852).