# DF-3676 — VERDICT

**status: inconclusive (hardening gap; currently unreachable with OOB values; no MPT hardware on guest)**

## Root cause

Every mpt XPT case that indexes `mpt->trt[lun]` validates the LUN first —
except the abort path:

```c
/* sys/dev/disk/mpt/mpt_cam.c:3683-3693 (XPT_{NOTIFY_ACK,IMMED_NOTIFY,ACCEPT_TARGET_IO}) */
		if (lun == CAM_LUN_WILDCARD) {
			...
		} else if (lun >= MPT_MAX_LUNS) {
			mpt_set_ccb_status(ccb, CAM_REQ_INVALID);   /* <-- guard */
			break;
		} else {
			trtp = &mpt->trt[lun];
		}
```

```c
/* sys/dev/disk/mpt/mpt_cam.c:4631-4635 (XPT_ABORT -> mpt_abort_target_ccb) */
	if (ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
		trtp = &mpt->trt_wildcard;
	} else {
		trtp = &mpt->trt[ccb->ccb_h.target_lun];   /* <-- no MPT_MAX_LUNS check */
	}
```

`trt[]` has MPT_MAX_LUNS = 256 entries (`mpt.h:367`, `mpt.h:709`). A LUN in
[256, CAM_LUN_WILDCARD) reads `tgt_resource_t` (two STAILQ heads + int)
out of bounds and STAILQ_REMOVEs from it (`mpt_cam.c:4645-4651`) — list
corruption.

## Reachability today (why Info, not Medium)

XPT_ABORT reaches mpt_action from userland via pass(4) (XPT_ABORT lacks
XPT_FC_XPT_ONLY — `cam_ccb.h:143`), but the abort CCB's path LUN is the
pass device's enumerated LUN, and CAM scans LUNs only up to
`cpi->max_lun` = MPT_MAX_LUNS (mpt reports 256 at `mpt_cam.c:3598-3599`;
SPI: 7). So no currently-reachable producer hands mpt a path LUN ≥ 256.
The check is nevertheless required at the SIM boundary because (a) CAM
does not enforce it centrally, (b) any future caller (xpt ioctl extension,
in-kernel periph) can construct arbitrary-LUN paths, and (c) the file's own
convention — every sibling case guards. This mirrors the sym(4) DF-3574
pattern filed as Info.

## Fix

```diff
--- a/sys/dev/disk/mpt/mpt_cam.c
+++ b/sys/dev/disk/mpt/mpt_cam.c
@@ -4628,8 +4628,12 @@ mpt_abort_target_ccb(struct mpt_softc *mpt, union ccb *ccb)
 	mpt_lprt(mpt, MPT_PRT_DEBUG, "aborting ccb %p\n", accb);
 
-	if (ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
+	if (ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
 		trtp = &mpt->trt_wildcard;
-	} else {
+	} else if (ccb->ccb_h.target_lun < MPT_MAX_LUNS) {
 		trtp = &mpt->trt[ccb->ccb_h.target_lun];
+	} else {
+		return (CAM_LUN_INVALID);
+	}
```

## Guest verdict

inconclusive (hardware-gated even for the benign reachability demo);
source-level gap certain.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.