{
  "finding_id": "DF-2498",
  "title": "Intel MatrixRAID heap OOB read via untrusted disk_idx and unvalidated map pointer",
  "verdict": "reproduced",
  "impact": "none",
  "impact_note": "impact enum has no 'silent memory corruption' value; demonstrated impact is a deterministic kernel-heap OOB WRITE (44 entries in-object past disks[15] + 11/11 entries past the 2424-byte allocation + adjacent chunk smashed) and an executed ~3.0MB OOB READ -- no panic or userland leak observed on the guest (same profile as DF-2494)",
  "reproduce": {
    "build": "guest /root/dfrig3: ./build.sh (production ata-raid.c #included into dfrig3_ata.ko)",
    "run": "kldload ./dfrig3_ata.ko; sysctl kern.dfrig3_ata_test=10; sysctl -n kern.dfrig3_ata_status; sysctl kern.dfrig3_ata_test=24; sysctl -n kern.dfrig3_ata_status",
    "expected": "test10 (map->total_disks=60): parse rc=1 retained; in-object proof disks[16].serial=d0d1 CONFIRMED; past-object proof 11/11 entries disks[49..59] carry 0xC0FFEE at victim+2488..+2992 (object ends +2424); guard[33] smashed 324/2424 bytes. test24 (disk_idx 1/0xffff mixed): loop-ran marker e0e1 CONFIRMED and the 0xffff iterations read meta+3145996 (~3.0MB past the 1536-byte object; zeroed heap here, no fault)."
  },
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:2165",
    "sys/dev/disk/nata/ata-raid.c:2190",
    "sys/dev/disk/nata/ata-raid.c:2230",
    "sys/dev/disk/nata/ata-raid.c:2243-2263",
    "sys/dev/disk/nata/ata-raid.c:2266-2283",
    "sys/dev/disk/nata/ata-raid.h:295-354"
  ],
  "fix": "fix.diff: in ata_raid_intel_read_meta() reject meta->total_disks outside [1,MAX_DISKS], reject map->total_disks outside [1,MAX_DISKS], skip disk_idx >= meta->total_disks",
  "artifacts": [
    "README.md", "VERDICT.md", "dfrig3_ata.c", "Makefile", "atastat.c",
    "build.sh", "run.sh", "run_nonfatal.log", "run_test23_24.log", "env.txt",
    "fix.diff", "fix_build.log", "fix_validation.log", "manifest.json", "verdict.json"
  ]
}