# DF-3843 — mrsas_sync_map_info: firmware `ldCount` drives an unbounded OOB write past the RAID-map DMA buffer

## Where
- `sys/dev/raid/mrsas/mrsas.c:3207` — `num_lds = map->raidMap.ldCount;` (full u32, firmware-authored)
- `sys/dev/raid/mrsas/mrsas.c:3210` — `size_sync_info = sizeof(MR_LD_TARGET_SYNC) * num_lds;` — **computed and never used**
- `sys/dev/raid/mrsas/mrsas.c:3213-3224` — write loop into `raidmap_mem[(map_id-1)&1]`, a fixed
  `map_sz = sizeof(MR_FW_RAID_MAP) + sizeof(MR_LD_SPAN_MAP)*(MAX_LOGICAL_DRIVES-1)` = **172,200-byte**
  `bus_dmamem_alloc` buffer (size set at `mrsas.c:1645-1646`)
- Validation gap: `sys/dev/raid/mrsas/mrsas_fp.c:257-265` (`MR_ValidateMapInfo`) only checks
  `totalSize == sizeof(MR_FW_RAID_MAP) - sizeof(MR_LD_SPAN_MAP) + sizeof(MR_LD_SPAN_MAP)*ldCount`
  in u32 arithmetic — the firmware supplies *both* sides of that equation, so any `ldCount` passes.

## Class
Linear kernel-heap overflow past a DMA allocation: length fully firmware-chosen (u32 count × 4 bytes),
content = per 4-byte entry `{targetId: FW u8, 0x00, seqNum: FW u16}` (3 of 4 bytes attacker-chosen).
The same loop also OOB-**reads** the *source* map via `MR_LdRaidGet(i)/MR_GetLDTgtId(i)`
(`mrsas_fp.c:174-182`, unbounded `ldSpanMap[i]`).

## Reachability
`mrsas_sync_map_info` is called from:
1. `mrsas_setup_raidmap` (`mrsas.c:1680`) at attach — after `MR_ValidateMapInfo` "passes",
2. `mrsas_complete_mptmfi_passthru` (`mrsas.c:2965`) on every RAID-map sync completion (AEN-driven),
3. `mrsas_reset_ctrl` (`mrsas.c:2477`) after OCR.

Threat actor: malicious/compromised controller firmware or a device that DMA-authors the map
(the map buffer is filled by the card). No purely-local unprivileged trigger — this is the same
gating as DF-1528 (mrsas_fp.c map reads), DF-1242/1243/1244.

## Reproduce (arithmetic proof on the audit guest)
```
./build.sh   # cc -O2 -Wall -o /tmp/df3843_proof map_sync_overflow_proof.c
./run.sh     # runs the harness; struct definitions copied verbatim from mrsas.h
```
Expected decisive lines (see run.log):
```
map_sz (mrsas.c:1645)       = 172200  <- bus_dmamem_alloc size
capacity in sync entries    = 43050  (max ldCount before OOB)
Firmware supplies ldCount=65536, totalSize=0x9e028a8:
  MR_ValidateMapInfo: totalSize(0x9e028a8) == expected(0x9e028a8) -> PASSES
  => 89944 bytes written PAST the end of the DMA allocation
```
The kernel-side execution itself needs a MegaRAID SAS HBA (Thunderbolt/Invader/Fury); the audit
QEMU guest has none (`no LSI/Avago PCI device present`, `no /dev/mrsas* nodes`) although the
driver is compiled into X86_64_GENERIC (`kldstat -v | grep mrsas` → `80 pci/mrsas`).