# DF-3912 — Verification Verdict

**Status:** not_reproduced (reproduced=0)
**Impact:** none on guest (no MPT HBA present)
**Confidence:** certain (source-level)

## Finding
`mpt_recv_handshake_reply()` computes `left = (hdr->MsgLength << 1) - 2`
from the IOC-authored reply header (first two doorbell words, :1450-1461)
and loops `while (left--)` (:1475-1477). MsgLength ∈ {0,1} yields left = -2
or 0; for -2 the post-decrement condition never terminates (int wrap), so
the loop exits only when `mpt_wait_db_int()` times out — up to
MPT_MAX_WAIT(300000) × 100 µs per attempt — and never if a malicious IOC
keeps MPT_DB_INTR asserted. The loop runs during attach/init handshakes with
MPT_LOCK held → livelock/DoS.

## Verification
- Source chain certain (README).
- Guest run (run.log): the harness loop with left=-2 ran 1e8 iterations
  without exiting and was cut only by the harness bound (the kernel has no
  such bound); rc=1. The kernel path requires an MPT IOC (absent — env.txt),
  hence not_reproduced-on-guest (device-gated), consistent with the DF-2481
  mpt precedent.

## Fix validation
`fix.diff`: `if (left < 0) left = 0;` after the subtraction. Applied with the
batch; nativekernel rebuild rc=0, mpt.c compiled in-kernel + KLD module with
`-Werror`, 0 errors (fix_build.log). fix_status = **fixed**
(compile-validated).

## Negative notes tied to this audit of the walk family
- Write side of the handshake walk is bounded (`reply_left-- > 0`, :1487).
- mpt_intr handler dispatch is masked: MPT_CONTEXT_TO_CBI ANDs with
  (MPT_NUM_REPLY_HANDLERS-1) (mpt.h:829-830) → no OOB function-pointer call;
  req_index is bounds-checked at mpt.c:811.
- tgt_cmd_ptrs access bounded at mpt.c:765-773.
- DF-1280 (address-reply offset) and DF-1281 (EventDataLength) remain the
  known walk bugs; not re-derived here.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.