# DF-3873 — mfi ioctl handlers dereference user ioctl buffers without copyin -> panic on unmapped args

DragonFly passes the *user* ioctl data pointer to d_ioctl handlers; drivers
must copyin. mfi_ioctl / mfi_user_command dereference it directly:

- mfi.c:2909-2916 (MFIIO_STATS): `ms->ms_item`, bcopy to `&ms->ms_qstat`
- mfi.c:2928-2943 (MFIIO_QUERY_DISK): reads `qd->array_id`, writes qd fields
- mfi.c:2950-2973 (MFI_CMD): `ioc->mfi_adapter_no`, `bcopy(ioc->mfi_frame.raw, ...)`
  and every later `ioc->mfi_sgl[...]` / `ioc->mfi_sense_*` access
- mfi.c:3126-3128 (MFI_SET_AEN): `aen->aen_seq_num`
- mfi.c:2818-2867 (MFIIO_PASSTHRU via mfi_user_command): `ioc->buf_size`,
  `copyin(ioc->buf,...)`, `bcopy(&ioc->ioc_frame,...)`, `bcopy(dcmd,&ioc->ioc_frame,...)`
  — the last one also *writes* through the raw user pointer.

An unmapped user address makes the kernel fault on a user VA with
`pcb_onfault == NULL`: DragonFly trap.c:905-925 prints "Fatal user address
access from kernel mode" and calls `trap_fatal()` -> panic. One ioctl with a
garbage arg pointer from any user holding /dev/mfi0 open (operator group).
The Linux shim cases (MFI_LINUX_CMD_2 / MFI_LINUX_SET_AEN_2) copyin properly,
showing the intended pattern.

## Build/run
```
cc -O2 -o mfi_ioctl_nullderef mfi_ioctl_nullderef.c   # trigger 3 = this finding
./mfi_ioctl_nullderef
```
Guest has no MegaRAID -> hardware-gated (run.log).