# DF-3911 — Verification Verdict

**Status:** inconclusive (reproduced=0)
**Impact:** none on guest (no MPT HBA present)
**Confidence:** certain (source-level)

## Finding
`mpt_download_fw()` walks the IOC-uploaded firmware image without validating
any header field:
- primary image: `mpt_diag_outsl(mpt, fw_hdr->LoadStartAddress,
  (uint32_t*)fw_hdr, fw_hdr->ImageSize)` — mpt.c:2469-2470; ImageSize (u32,
  offset 0x2C in MpiFwHeader_t) vs the allocation (`mpt->fw_image_size` =
  ioc_facts.FWImageSize, mpt.c:2751) never cross-checked → OOB read up to
  4 GiB past the DMA-coherent buffer, streamed dword-by-dword to the PCI
  diag data port (mpt_diag_outsl, mpt.c:2422-2440).
- extension chain: `ext = (MpiExtImageHeader_t *)((uintptr_t)fw_hdr +
  ext_offset)` with ext_offset = NextImageHeaderOffset (u32) unvalidated —
  mpt.c:2474-2482 → wild reads; attacker-chosen offsets; can loop forever.
Threat model: malicious or faulty IOC (hardware-level attacker), same gate
as DF-1279/DF-1280/DF-2481 (which covered different fields).

## Verification
- Source chain certain (README).
- Guest run (run.log): performing the identical ext-header read at
  fw_image+0xfffff000 faults immediately ("Bus error (core dumped)") — the
  userspace analogue of the kernel page fault; the ImageSize>allocation form
  is printed before it. The kernel path itself needs an MPT IOC (absent —
  env.txt shows no LSI device on the PCI bus), hence inconclusive, matching
  the DF-1280 precedent.

## Fix validation
`fix.diff` bounds ImageSize, ext_offset and ext->ImageSize against
fw_image_size (EIO on violation). Applied with the batch; nativekernel
rebuild rc=0, mpt.c compiled in-kernel (fix_kernel_full.log:16461 in the
DF-3908 pack) and as a KLD module (:24168) with `-Werror`, 0 errors.
fix_status = **fixed** (compile-validated).

## Notes
This is the mpt(4) analogue of the mps/mpr "trust the controller's
self-reported image/facts" family (DF-3800/3813/3814). The checklist (e)
realloc/iocfacts twin in this file — mpt_configure_ioc retry paths re-running
mpt_dma_buf_alloc and leaking DMA memory — is real but shadowed by the
known infinite recursion DF-1278 (the recursion never returns, so the leak
is unbounded-but-moot); noted in the file's negative notes rather than filed.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.