# DF-3964 — firmware-fed adapter config consumed unvalidated: `max_sg_count-1` maxsize underflow, `max_requests-1` queue depth

**File:** sys/dev/raid/hptiop/hptiop.c (pass 2; DF-1313 covered the ioctl size
check, not these attach-time consumers)

## What
`hptiop_attach` trusts the get_config reply verbatim (1928–1933). Consumers:
- io_dmat `maxsize = PAGE_SIZE * (hba->max_sg_count-1)` (1951): with
  max_sg_count==0 this is PAGE_SIZE*0xffffffff → underflowed 64-bit maxsize
  handed to bus_dma_tag_create (1946–1959).
- `cam_simq_alloc(hba->max_requests - 1)` (1993,1999): max_requests==0 →
  openings = −1 → 4 G openings advertised over a 256-srb pool.
- `max_devices` gates target ids (2281) and `max_target` (2374).

Device-gated robustness/Low: outcome is failed attach, bogus DMA geometry, or
degenerate CAM behaviour — not host memory corruption by itself.

## Build / Run
Hardware-gated; see trigger.c.