# DF-3821 — aac(4) trusts the adapter-reported FIB geometry from GETCOMMPREF: zero `max_fib_size` panics at attach (divide by zero), sub-header sizes overflow FIB slots

- **File:** `sys/dev/raid/aac/aac.c`
- **Lines:** 1800-1811 (geometry), 3010-3011 (28-byte header copyin)
- **Class:** CWE-20/CWE-369 (unvalidated external value → divide-by-zero
  panic) + CWE-787 (undersized DMA heap slots overflowed by fixed-size
  header copy)
- **Reach:** attach-time only, driven by adapter mailbox data.

## Analysis

`aac_check_firmware()` (aac.c:1800-1811):

```c
1800:	if (!aac_sync_command(sc, AAC_MONKER_GETCOMMPREF, 0, 0, 0, 0, NULL)) {
1801:		options = AAC_GET_MAILBOX(sc, 1);
1802:		sc->aac_max_fib_size = (options & 0xFFFF);
...
1809:	if (sc->aac_max_fib_size > PAGE_SIZE)
1810:		sc->aac_max_fib_size = PAGE_SIZE;
1811:	sc->aac_max_fibs_alloc = PAGE_SIZE / sc->aac_max_fib_size;
```

Only an *upper* clamp exists.

- **`options & 0xFFFF == 0`** (firmware returns 0 in the low mailbox
  word): line 1811 executes `PAGE_SIZE / 0` → x86 #DE → **kernel panic
  during device attach** (boot-time DoS on machines whose (buggy) card
  reports that).
- **`0 < max_fib_size < sizeof(struct aac_fib)` (512)**: FIB slots are
  allocated `aac_max_fibs_alloc * aac_max_fib_size` bytes with each
  `cm->cm_fib` spaced `aac_max_fib_size` apart (aac.c:1455-1476).  With a
  sub-512 report (e.g. 64), `aac_ioctl_sendfib()` still does an
  unconditional `copyin(ufib, cm->cm_fib, sizeof(struct aac_fib_header))`
  (28 bytes, aac.c:3010-3011) — for the **last** slot of the final
  `aac_alloc_commands()` block this writes past the end of the
  `bus_dmamem_alloc`'d FIB pool (heap/DMA memory corruption, up to 27
  bytes past for `max_fib_size == 1`, up to 12 bytes past for 16, …).
- Note `sc->aac_max_fibs = (options & 0xFFFF)` (aac.c:1807) is likewise
  unvalidated but only drives an allocation size (≤ 65535 × ~120 bytes),
  not an overflow.

Both require misbehaving/compromised controller firmware — the classic
device-trust precondition — but the divide-by-zero is a *boot-time panic*
on a merely buggy firmware revision, which elevates it above pure
hardening.

## Verdict

`inconclusive` — no AAC hardware on the audit guest (see
../DF-3819/env.txt); the geometry values come from the adapter mailbox.
Source-level: certain.