# DF-2486 — Kernel heap info leak via uninitialized DMA buffer

## Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

## Hardware gate

No LSI Logic MPT HBA in guest: `kldstat` shows only kernel/ehci/xhci; `pciconf -l`
shows no LSI device. No `/dev/mptN` device node exists.

## Source trace (confirmed real bug)

**File:** `sys/dev/disk/mpt/mpt_user.c:203` (and ioctl switch at 672-685, 698-711)

`mpt_alloc_buffer` calls `bus_dmamem_alloc` at line 203 **without `BUS_DMA_ZERO``,
so the buffer contains stale kernel heap. In the `MPTIO_READ_CFG_PAGE` path (line
672-686): only the 4-byte page header is copyin'd before the IOC fills the page;
the handler then `copyout`s the full user-supplied `len` (up to 16MB) at line 685,
returning bytes `[4..len)` as uninitialized kernel heap. Same for
`MPTIO_READ_EXT_CFG_PAGE` at 711 (bytes `[8..len)`). `busdma_machdep` only ORs
`M_ZERO` when `BUS_DMA_ZERO` is passed; `kmalloc` does not zero by default.

## Fix

Added `BUS_DMA_ZERO` to the `bus_dmamem_alloc` call in `mpt_alloc_buffer`.
See `fix.diff`.

## Impact (on HW that has the HBA)

Medium — kernel heap info leak of up to 16MB per ioctl call. Device node is
`0640 root:operator`, operator-group access suffices.