{
  "finding_id": "DF-3914",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain heap OOB write (CWE-787), pass 2. The firmware-supplied enclosure NumSlots (mpr_mapping.c:2843, only !=0-checked at :2760) is never bounded against the mapping-table size on the DIRECT-ATTACHED reservation path of _mapping_get_dev_info (:1241-1243 -> unbounded loop :1292-1299) and _mapping_get_pcie_dev_info (:1392-1394 -> :1443-1450); the expander path is bounded via _mapping_find_enc_map_space (:979-993), the DA path bypasses it. mapping_table is kmalloc(max_devices*32) (:2140), so an enclosure reporting more slots than free table space produces a linear overflow of up to ~2MB writing the fully firmware-controlled 64-bit enclosure SAS address at a 32-byte stride. Distinct from DF-1282 (DPM-pg0 DeviceIndex write) and DF-1283 (slot-start_slot underflow). Not reproduced at kernel level on the QEMU guest: no LSI/Avago SAS3 HBA present (pciconf in env.txt - virtio-only PCI bus), so mpr_attach never runs; same hardware gate as DF-1282/DF-3800. Primitive proven at object level on the guest: harness replicates the exact structs and verbatim loop; with NumSlots=2048 vs max_devices=264 it smashes 1,785 guard entries (57,120 bytes) past the 8,448-byte allocation with the attacker value at stride 32 (run.log, stable across reruns).",
  "exploit_chain": "Hardware-gated chain (not executable on this guest): malicious/compromised enclosure SES data or IOC firmware -> Enclosure Status Change event with NumSlots > free space -> SAS/PCIe Topology Change event (direct-attached) -> _mapping_get_dev_info/_mapping_get_pcie_dev_info reservation loop -> linear heap overflow past mapping_table with fw-controlled qword per 32 bytes into adjacent kmalloc zones -> slab metadata / neighboring object corruption -> kernel code execution. Stopped at primitive proof: no HBA.",
  "evidence": "run.log/run.2.log (guest harness output: 57,120-byte canary smash with 0x5141524153534141 at stride 32), harness_df3914.c (verbatim loop replication), env.txt (hardware gate), VERDICT.md (line-by-line source chain), fix.diff + fix_build.log (patched kernel compiled -Werror clean, completed)",
  "kernel_refs": [
    "sys/dev/raid/mpr/mpr_mapping.c:2843",
    "sys/dev/raid/mpr/mpr_mapping.c:2760",
    "sys/dev/raid/mpr/mpr_mapping.c:1241",
    "sys/dev/raid/mpr/mpr_mapping.c:1292",
    "sys/dev/raid/mpr/mpr_mapping.c:1392",
    "sys/dev/raid/mpr/mpr_mapping.c:1443",
    "sys/dev/raid/mpr/mpr_mapping.c:979",
    "sys/dev/raid/mpr/mpr_mapping.c:2140",
    "sys/dev/raid/mpr/mpr_mapping.c:2565"
  ],
  "poc_changes": "No seed PoC existed (pass-2 finding). Harness authored against the exact struct layout (mprvar.h:113) with the verbatim :1292-1299 loop; built and run on the audit guest with cc 8.3.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o harness_df3914 harness_df3914.c",
  "run_cmd": "./harness_df3914",
  "code_hash": "7fcf0128c2202e1d4dffc18acc5fd8c7c13903eaecb6b1a21765ce557eae7187",
  "notes": "Upstream FreeBSD head shares the unbounded DA path (verified against cgit.freebsd.org src/sys/dev/mpr/mpr_mapping.c). Guest /usr/src restored to pristine after fix build; guest reset with clean-source snapshot performed.",
  "recommended_fix": "Bound et_entry->num_slots by (sc->max_devices - num_rsvd_entries) on both direct-attached paths in _mapping_get_dev_info/_mapping_get_pcie_dev_info and reject the enclosure using the existing no-space handling.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to the guest /usr/src copy (together with DF-3915s diff, git apply --check clean on the pristine tree); make nativekernel KERNCONF=X86_64_GENERIC rebuilt mpr_mapping.c with -Werror in both static-kernel and KLD_MODULE passes and completed the kernel+module link with zero diagnostics (fix_build.log; full log SHA256 55641f6d20f32d6795026dd86d27cd571a9186beb0333830050a386f1fb57368). Runtime fix validation not testable: exercising the path requires an mpr(4) HBA delivering the malicious enclosure event, absent on this guest.",
  "fix_evidence": "findings/poc/DF-3914/fix.diff, findings/poc/DF-3914/fix_build.log"
}