# DF-2494 — `ata_raid_lsiv2_read_meta()` stores `ar_softc*` out of bounds past the global `ata_raid_arrays[16]` via untrusted on-disk `raid_number` (plus same-parse `disks[disk_number]` heap OOB)

**File:** `sys/dev/disk/nata/ata-raid.c:2770-2884` · **Severity:** High · **Bucket:** memcorrupt · **Confidence:** certain
**Status: reproduced on the QEMU guest** (production-code KLD rig, DF-5302/DF-5321/DF-5413
evidence class; the nata `ata`-bus `subdisk` attach path that feeds this parser is only
reachable with an ATA disk on an nata controller, and the standard vm.sh QEMU guest
cannot take an IDE hard disk at all — see VERDICT.md).

## Build (guest, root)

```
cd /root/dfrig && ./build.sh     # compiles production ata-raid.c into dfrig_ata.ko
```

## Run

```
sh run.sh                        # rig tests 1, 2, 4 (survivable proofs)
sysctl kern.dfrig_ata_test=5     # +2040 store then configs[255] OOB read (serial log)
sysctl kern.dfrig_ata_test=6     # REAL kernel ata_raid_arrays target (boot-attack arm)
```

## Expected (see run.log)

* test 1: production parse stores `0xfffff80116973700` at `raidp[29]` — 104 bytes past
  the 128-byte `ata_raid_arrays[16]`; parse returns 1 (array accepted).
* test 2: first OOB slot `raidp[16]` (= `&atapi_cam_devclass` in the real kernel)
  written and retained.
* test 4: same parse writes `raid->disks[49]` 40 bytes past the 2424-byte
  `struct ar_softc` allocation (`dev` pointer, `flags=0xb`).
* test 6: with `raidp` = the REAL kernel `ata_raid_arrays` (0xffffffff8114dec0), the
  production skip-occupied walk plants/uses pointers in real kernel BSS and heap past
  the array — cross-subsystem corruption, silent.

## Fix

`fix.diff` (shared shape with the DF-2495 pack): validate `meta->raid_number <
MAX_ARRAYS` and `meta->disk_number < MAX_DISKS` in `ata_raid_lsiv2_read_meta()`.
Validated on a rebuilt kernel (fix_build.log / fix_run.log).