{
  "finding_id": "DF-3961",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain missing SG-capacity bound: hptiop_post_req_itl(non-highmem)/mv/mvfrey write nsegs*16 bytes of scatter-gather into the 600-byte srb->req[] buffer whose capacity is 34 entries (offsetof(sg_list)=48), with the only gate being the firmware-fed max_sg_count (hptiop.c:2660 vs :1933; io_dmat nsegments=max_sg_count at :1952). nsegs>=35 overwrites srb->hba/ccb/next/dma_map/phy_addr (hptiop.h:452-461 layout) which the completion callbacks dereference (ccb=srb->ccb; xpt_done(ccb)). Not DF-1311 (that is the stack local of the HIGH_MEM_ACESS itl branch at :2417-2457). Not reproduced: guest has no HighPoint HBA (env.txt); additionally, on this platform reachability is marginal because MAXPHYS=128K caps the bus_dmamap_load path at <=34 segments (scsi_da.c:1248) and no in-tree initiator sets CAM_SCATTER_VALID \u2014 so exploitation needs firmware reporting >=35 AND a >=35-segment originator. Downgraded to Medium accordingly.",
  "exploit_chain": "device reports max_sg_count>=35 -> originator supplies 35+ segment CCB -> SG entries 34..37 overwrite srb->hba/ccb/dma_map/phy_addr with {ds_len, 0, ds_addr} triples (semi-controlled physical addresses of the I/O buffer) -> firmware completes the command -> hptiop_request_callback_* reads ccb from corrupted srb->ccb and calls xpt_done(ccb) on a forged pointer -> panic or groomed corruption (undemonstrated; requires hardware).",
  "evidence": "VERDICT.md (layout math + path:line chain), trigger.c (sink/bound analysis + hardware recipe), env.txt (guest hardware absence), fix.diff (capacity clamp, git apply --check clean)",
  "kernel_refs": [
    "sys/dev/raid/hptiop/hptiop.c:2471",
    "sys/dev/raid/hptiop/hptiop.c:2480",
    "sys/dev/raid/hptiop/hptiop.c:2539",
    "sys/dev/raid/hptiop/hptiop.c:2593",
    "sys/dev/raid/hptiop/hptiop.c:2600",
    "sys/dev/raid/hptiop/hptiop.c:2660",
    "sys/dev/raid/hptiop/hptiop.c:1933",
    "sys/dev/raid/hptiop/hptiop.c:1952",
    "sys/dev/raid/hptiop/hptiop.h:42",
    "sys/dev/raid/hptiop/hptiop.h:452",
    "sys/bus/cam/scsi/scsi_da.c:1248"
  ],
  "poc_changes": "No runnable PoC: trigger is hardware-gated (HighPoint HBA + firmware reporting max_sg_count>=35). trigger.c documents the exact sink math, both preconditions and the on-hardware recipe.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "guest: cd /usr/src/sys/dev/raid/hptiop && patch -p1 < fix.diff && make   # after make obj",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -lv | grep -iE \"ralink|highpoint|1103\"; ls -la /boot/kernel/hptiop.ko",
  "code_hash": "42a0315018070475f7a16c75cc75fcc749e911922c1592a1622b9ae9c3b4d9bb",
  "notes": "Pass-2 finding. Excluded knowns: DF-1311 (stack, HIGH_MEM_ACESS itl only), DF-1312 (srb[] index), DF-1313 (ioctl ordering/max_request_size). Sibling drivers hptmv/hpt27xx have the same shape but were not audited here. hw.busdma on guest: max_bpages=1024.",
  "recommended_fix": "Clamp firmware-reported max_sg_count to the real srb->req[] SG capacity (34) at attach (fix.diff: HPT_SRB_MAX_SG_COUNT).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff clamps hba->max_sg_count to HPT_SRB_MAX_SG_COUNT (34) at attach, which simultaneously bounds the post_scsi_command check, io_dmat nsegments and the maxsize math; git apply --check passes against pristine sys/. Runtime validation impossible on the audit guest (baseline itself needs the HBA) fix.diff applied to the guest /usr/src copy and the hptiop.ko module rebuilt clean with -Werror (build.log; combined with the other four hptiop fix.diffs of this batch); runtime validation still impossible without the HBA.",
  "fix_evidence": "fix.diff (git apply --check clean); no fix_build.log/fix_run.log possible without hardware; fix.diff applied to the guest /usr/src copy and the hptiop.ko module rebuilt clean with -Werror (build.log; combined with the other four hptiop fix.diffs of this batch); runtime validation still impossible without the HBA."
}