# DF-2485 verdict -- mpt_raid config-page count loops walk past the page allocation

status: reproduced   reproduced: 1   impact: limited_write
confidence: certain   attempts: 2   runtime_sec: 900

The verbatim mpt_refresh_raid_data and mpt_announce_vol iterate device-supplied counts (ioc_page3->NumPhysDisks :1401, ioc_page2->NumActiveVolumes :1432, vol_pg->NumPhysDisks :1149) over trailing arrays without checking the counts fit the page. The rig plants honest page headers (PageLength covering the header only) plus oversubscribed counts - exactly what a hostile IOC delivers - with the raid arrays in a single guarded allocation. Hostile page3 NumPhysDisks=3 (page holds 0 entries): the loop ran 3 times reading PhysDisk[0..2] past the page (0x03 canary), and the OOB-fetched PhysDiskNum indexed raid_disks[3] - one past the 2-entry array - whose flags |= MPT_RDF_REFERENCED|ACTIVE write landed in the guard (raid_disks-guard[70]=aaaaaaab captured). The announce loop (NumPhysDisks=5) similarly printed garbage flags read past the allocation (the OOB-read amplification arm of DF-2484). Control (honest counts) clean. Fix (clamp counts to the PageLength-derived maximum) A/B: no guard smash. HW-gated at runtime (no LSI MPT controller on the guest).

## Evidence (decisive lines)
DF2485[HOSTILE]: page3 NumPhysDisks=3 (page holds 0 entries), page2 NumActiveVolumes=2 (page holds 0)
DF2485: driver log: read_cfg_page(len=0) refresh_disk refresh_disk refresh_disk read_cfg_page(len=0) mpt_announce_disk D raid_disks-guard[70]=aaaaaaab
DF2485: RESULT=COUNT-DRIVEN OOB (loops walked past the page allocation; OOB-fetched PhysDiskNum indexed raid_disks[] OOB)
DF2485[announce]: 5 member lines printed from OOB PhysDisk[] reads (Quiesced/Was Non-Optimal/Offline/Other garbage)
--- control ---
DF2485[CONTROL]: ... RESULT=clean (honest counts)
--- fixed source A/B ---
DF2485: guard smashed=0 (clamped loops; no raid_disks OOB write)




## Exploit chain / privesc assessment
malicious/faulty IOC (PCI trust boundary); OOB read of the page plus an IOC-indexed OOB |= write into raid_disks (limited write primitive per this findings scope; DF-2484 owns the far-index arm).

## Fix + A/B
fix.diff clamps all three counts to the page-header-derived maximum; note in diff: allocation-size validation belongs in the page-read path.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.