# DF-3963 — mv queue-pointer registers trusted raw: device-fed OOB MMIO read *and write* off the 512-entry queue arrays

**File:** sys/dev/raid/hptiop/hptiop.c (pass 2; knowns excluded — DF-1312 covers
the `hba->srb[]` index, not these queue-pointer registers)

## What
`hptiop_mv_outbound_read` (229–250) reads the device register `outbound_tail`
and uses it *unmasked* as the index `outbound_q[outbound_tail]` — an MMIO read
at BAR2+0x1040+8*tail. `hptiop_mv_inbound_write` (252–265) likewise writes 8
host-chosen bytes at BAR2+0x40+8*`inbound_head`, unmasked. The arrays are 512
entries (MVIOP_QUEUE_LEN, hptiop.h:96–107). A device value ≥ 512 (or a
device-DMA attacker flipping the register) steers the access up to ~32 GB past
BAR2. Host RAM is not behind the BAR, so impact is machine-check/panic
(unmapped MMIO) or corruption of a neighbouring mapped BAR — a device-fed DoS
/MMIO-corruption primitive. Complements DF-1312 (which is the srb[] index fed
from the *popped* queue values); these are the *queue pointer registers*
themselves.

## Build / Run
Hardware-gated (mv-family RR3020/3120 HBA required; guest has none — env.txt).

## Expected
Fatal trap / machine check on the OOB MMIO access, or silent corruption of an
adjacent device's register file.