# DF-3816 — VERDICT

**status: inconclusive (runtime)** — sysctl node requires an instantiated
controller (`dev.mpr.N` does not exist on this guest, probe.log); source
defects are certain.

## Source trace

- sysctl registration: mpr.c:1846-1848 (CTLTYPE_OPAQUE|CTLFLAG_RD|CTLFLAG_SKIP,
  handler `mpr_dump_reqs`, arg1 = sc).
- privilege gate: mpr.c:1888 (`caps_priv_check_self(SYSCAP_NODRIVER)`).
- read-only guard: mpr.c:1895 (`req->newptr != NULL → EINVAL`).
- unlocked walk: mpr.c:1904 comment "Best effort, no locking"; loop
  mpr.c:1905-1922 reads `cm->cm_state`, `cm->cm_desc`, walks
  `cm->cm_chain_list` twice. Every other consumer of these fields holds
  `sc->mpr_lock` (intr path mpr.c:2269-2271, completion/freepath
  mprvar.h:568-602); chains are inserted at mpr.c:3182 under the lock and
  freed to `sc->chain_list` at mprvar.h:592-595 — a concurrent completion
  mutates the list mid-`TAILQ_FOREACH_MUTABLE` → traversal can follow a
  `chain_link` that was just kfreed... (chains aren't kfreed individually —
  they return to the pool — but the element is simultaneously re-armed onto
  another command's list, so the dump can follow into another command's
  chain or loop; on the realloc path mpr.c:787-788 the entire `sc->chains`
  array IS kfreed → true UAF).
- fixed-size copies: mpr.c:1918 `sbuf_bcat(sb, cm->cm_req, 128)` with
  `cm->cm_req = req_frames + i*reqframesz` (mpr.c:1530) — last frame reads
  `128 - reqframesz` bytes past the allocation when the device reports
  IOCRequestFrameSize < 32 dwords; mpr.c:1921 same for chain frames of
  `sc->chain_frame_size` bytes (mpr.c:397-405, can be 32/48/64…).

## Impact ceiling

Privileged debug interface → info-leak of freed/adjacent DMA-coherent heap
into a sysctl buffer + panic under race. Low severity, defense-in-depth fix.

## Fix

`fix.diff`: hold `mpr_lock` across the loop; clamp copies with `min()`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.