# DF-2902 — unvalidated `d_media_blksize` in mbrinit → oversized kernel read into 128 KB pbuf

## What
`mbrinit()` (sys/kern/subr_diskmbr.c:127-132) issues a synchronous read of
exactly `info->d_media_blksize` bytes into a `getpbuf_mem()` pbuf whose
buffer is only MAXPHYS (128 KB on x86_64) bytes:

```c
bp = getpbuf_mem(NULL);
KKASSERT((int)info->d_media_blksize <= bp->b_bufsize);   /* :128 — broken guard */
bp->b_bio1.bio_offset = (off_t)mbr_offset * info->d_media_blksize;
bp->b_bcount = info->d_media_blksize;                    /* :132 — sink */
```

The guard is broken twice:
1. `KKASSERT` is compiled out entirely on non-INVARIANTS (production) kernels.
2. The `(int)` cast makes any block size ≥ 2^31 (e.g. 0x80000000 → INT_MIN)
   *pass* the assertion even on INVARIANTS kernels.

`d_media_blksize` is attacker-controllable by any malicious storage device:
`scsi_da.c:dasetgeom()` copies the READ CAPACITY `length` field verbatim into
`softc->params.secsize` (sys/bus/cam/scsi/scsi_da.c:2289) with no validation,
so a USB mass-storage gadget answering READ CAPACITY with `length=0x80000000`
delivers it straight into mbrinit at plug-in (devd/CAM auto-probe runs as
root).  The same value flows to `mbr_extended()` (subr_diskmbr.c:435-439).

## Observed (stock INVARIANTS guest, DragonFly 6.5-DEVELOPMENT)
* blksize = 0x40000 (256 KB): `panic: assertion "(int)info->d_media_blksize
  <= bp->b_bufsize" failed in mbrinit at subr_diskmbr.c:128` (see
  panic_runA.txt).
* blksize = 0x80000000 (2 GiB): assertion BYPASSED via the cast; the read is
  issued with `b_bcount = 0x80000000` into the 128 KB pbuf; the transfer
  memmove runs off the end of the mapped buffer → kernel-mode page fault:
  `trap 0xc, rip = memmove+0x10a` (see panic_runB.txt).  The overflow
  content is the attacker's data (the bytes the device/backing file
  supplies).

## Threat
Crafted MBR media is NOT required — only a device that lies about its block
size (USB mass-storage, malicious virtual disk, misbehaving HBA).  On the
real CAM path the same `b_bcount` becomes the SCSI `dxfer_len`
(scsi_da.c:1492-1506, `scsi_minphys` is `#if 0`'d), i.e. a device-directed
DMA of up to 2 GiB into a 128 KB kernel buffer — attacker-chosen content and
length: code-execution-grade primitive.  Reach: plug-in auto-probe (no
privilege needed by the attacker beyond physical access).

## Reproduce (guest, root)
```
dd if=/dev/zero of=/root/med.img bs=1m count=256
vnconfig -c -S 512 vn0 /root/med.img        # clean zero media
cd /root/mbrprobe && make                   # KLD harness
kenv mbrprobe.blksize=262144   && kldload ./a/mbrprobe_a.ko   # panic at :128
# reset, reattach vn, then:
kenv mbrprobe.blksize=2147483648 && kldload ./b/mbrprobe_b.ko # OOB memmove panic
```
Success criterion: panics above on the stock kernel; after fix.diff both
runs print `mbrprobe: mbrinit returned 5` (EIO) and the guest stays up.