+ cc -O2 -o harness harness.c
-rwxr-xr-x  1 maxx  maxx  8200 Jul 20 20:16 harness
+ ./harness
DF-1917: mrsas_passthru unbounded sgl_off (mrsas_ioctl.c:219-255)
  cmd->frame is bus_dmamem_alloc'd at MRSAS_MFI_FRAME_SIZE=1024
  bytes (mrsas.c:451-462 mrsas_create_frame_pool).  sgl_off is a
  u32 from userspace (mrsas_ioctl.h:83), never validated.

  sgl_off=0x00000080 sge_count= 1 -> 0 OOB bytes (in-bounds)
  sgl_off=0x000003f8 sge_count= 1 -> 0 OOB bytes (in-bounds)
  sgl_off=0x000003fc sge_count= 1 -> 4 OOB bytes (OOB WRITE past 1024-byte frame)
  sgl_off=0x00000400 sge_count= 1 -> 8 OOB bytes (OOB WRITE past 1024-byte frame)
  sgl_off=0x000003fc sge_count=16 -> 124 OOB bytes (OOB WRITE past 1024-byte frame)
  sgl_off=0xffffffff sge_count= 1 -> 8 OOB bytes (OOB WRITE past 1024-byte frame)

  Confirmed: every case with OOB bytes > 0 writes attacker-supplied
  phys_addr/length past the cmd->frame DMA allocation.
RUN_EXIT=0