# DF-1918 PoC

Trigger: pass `sense_off = 1017..0xFFFFFFFF` and any non-zero `sense_len`
in an `MRSAS_IOC_FIRMWARE_PASS_THROUGH` ioctl on `/dev/mrsas0`. The driver
computes `sense_ptr = (unsigned long *)(cmd->frame + sense_off)` and
unconditionally stores the 8-byte physical address of the sense buffer at
that offset, without ever checking `sense_off + sizeof(unsigned long) <=
MRSAS_MFI_FRAME_SIZE (1024)`. `sense_off >= 1017` spills 1..8 bytes past
the 1024-byte DMA frame; `sense_off = 0xFFFFFFF8` wraps the pointer to
`cmd->frame - 8`.

## Preconditions

* An LSI MegaRAID SAS HBA present (mrsas_attach creates the cdev).
* `/dev/mrsas0` is created mode `0660 root:operator`
  (`sys/dev/raid/mrsas/mrsas.c:790-792`), so the caller must be `root` or
  in the `operator` group.

**Phase-6 hard blocker on this guest.** Same as DF-1917 — no MegaRAID SAS
HBA in the QEMU audit guest (verified), so `mrsas_passthru` is
unreachable, and `maxx` is not in `operator` anyway.

## Build

```
cc -O2 -o harness harness.c
```

## Run

```
./harness
```

## Expected output

For each `sense_off` test vector, the harness prints the byte count of the
8-byte `*sense_ptr = phys_addr` store that lands past the 1024-byte frame
model. In-bounds cases print 0; OOB cases print 1..8.

## Fix

See `fix.diff`: after computing `user_ioc->sense_off`, require
`user_ioc->sense_off <= MRSAS_MFI_FRAME_SIZE - sizeof(unsigned long)`
before issuing the store.