# DF-3872 — mfi_check_for_sscd() dereferences NULL cm_data (MFI_CMD, DCMD CFG_ADD, data_len=0)

mfi.c:3040 calls `skip_pre_post = mfi_check_for_sscd(sc, cm);` for every
MFI_CMD ioctl before the pre/post command checks. Inside (mfi.c:2677-2685):

```c
struct mfi_config_data *conf_data = cm->cm_data;
...
if ((cm->cm_frame->dcmd.opcode == MFI_DCMD_CFG_ADD) &&
    (conf_data->ld[0].params.isSSCD == 1)) {
```

With a user frame of `cmd=MFI_CMD_DCMD`, `opcode=MFI_DCMD_CFG_ADD (0x04020000)`,
`data_len=0` and no DATAIN/DATAOUT flags, mfi.c:2996-3002 leaves
`cm->cm_data = 0`, so `conf_data->ld[0].params.isSSCD` reads at
NULL + offsetof(mfi_config_data, ld[0].params.isSSCD) (~2.5 KB, past
`array[MFI_MAX_ARRAYS]`) — kernel read of unmapped low memory ->
trap_fatal -> panic. Single ioctl, no firmware roundtrip needed.

Secondary: with a small-but-nonzero data_len (< offsetof(ld[0])), the same
expression is a heap OOB read whose garbage value can force `skip_pre_post=1`,
bypassing mfi_check_command_pre/post for CFG_ADD.

## Build/run
```
cc -O2 -o mfi_ioctl_nullderef mfi_ioctl_nullderef.c   # trigger 2 = this finding
./mfi_ioctl_nullderef
```
Guest has no MegaRAID -> hardware-gated (run.log).