# DF-1917 PoC

Trigger: pass `sgl_off = 1020..0xFFFFFFFF` and `sge_count = 1..16` in an
`MRSAS_IOC_FIRMWARE_PASS_THROUGH` ioctl on `/dev/mrsas0`. The driver writes
up to 16 × 8-byte SGE entries (`mrsas_sge32 { u32 phys_addr; u32 length; }`)
at `cmd->frame + sgl_off + 8*i` without ever checking that
`sgl_off + 8*sge_count <= MRSAS_MFI_FRAME_SIZE (1024)`, so the writes spill
past the 1024-byte `bus_dmamem_alloc`'d DMA frame into adjacent kernel heap.

## Preconditions

* An LSI MegaRAID SAS HBA present (mrsas_attach creates the cdev).
* `/dev/mrsas0` is created mode `0660 root:operator`
  (`sys/dev/raid/mrsas/mrsas.c:790-792`), so the caller must be `root` or
  in the `operator` group.

**Phase-6 hard blocker on this guest.** The QEMU audit guest emulates no
MegaRAID SAS HBA (verified: `pciconf -lv` lists none, `/dev/mrsas*` absent),
so `mrsas_passthru` is unreachable at runtime; and even on a host with the
HBA, `maxx` (uid 1001) is not in `operator` (verified), so the
unprivileged ceiling is "operator-group member". No `uid=0` claim — the bug
is real, the live path is closed on this guest.

## Build

```
cc -O2 -o harness harness.c
```

## Run

```
./harness
```

## Expected output

The harness reproduces the verbatim buggy arithmetic of
`mrsas_ioctl.c:219-255` against a 1024-byte model of `cmd->frame` and
prints, for each `(sgl_off, sge_count)` test vector, the number of bytes
the SGE writes would land past the 1024-byte DMA allocation. In-bounds
cases print 0; OOB cases print 4..128 (single SGE) up to 124 (16 SGEs at
offset 1020). `sgl_off = 0xFFFFFFFF` shows the pointer-wrap variant.

## Fix

See `fix.diff`: clamp `sgl_off + sge_count * sizeof(struct mrsas_sge32) <=
MRSAS_MFI_FRAME_SIZE` immediately after reading `user_ioc->sgl_off`, return
`EINVAL` otherwise.