# DF-3817 — mpr_log_evt_handler(): hexdump() of EventData with device-controlled length (OOB read of reply-frame buffer to console)

## What

`mpr_log_evt_handler()` (sys/dev/raid/mpr/mpr.c:2053-2078):

```c
case MPI2_EVENT_LOG_DATA:
        mpr_dprint(sc, MPR_EVENT, "MPI2_EVENT_LOG_DATA:\n");
        if (sc->mpr_debug & MPR_EVENT)
                hexdump(event->EventData, event->EventDataLength, NULL, 0);  /* mpr.c:2065 */
```

`event->EventDataLength` is a U16 taken verbatim from the firmware's event
notification reply (a device-controlled DMA buffer). Per the MPI2
specification it counts **32-bit words**, and the driver never validates it
against the reply frame size (`sc->replyframesz`, mpr.c:1346 =
`facts->ReplyFrameSize * 4`, typically 96-128 bytes). `hexdump()` interprets
it as a byte count:

- semantics bug: under-dumps legitimate events (1/4 of the data);
- security bug: a firmware value > the remaining frame bytes makes hexdump
  read up to 65535 bytes past the `EventData` pointer — an OOB read of the
  kernel heap adjacent to the reply-frames DMA allocation, printed to the
  console (dmesg/console log).

Gate: requires `hw.mpr.N.debug_level` to have MPR_EVENT set (root sysctl or
loader tunable; the default mpr.c:1672 is MPR_INFO|MPR_FAULT) **and** a
device that sends a LOG_DATA event with an oversized length — broken or
malicious firmware/DMA. Same device-trust family as DF-3815.

## Not runnable here

No SAS3 controller on the guest (probe.log); event delivery cannot occur.

## Fix

`fix.diff`: convert words→bytes and clamp to the bytes remaining in the
reply frame.