# DF-4077 VERDICT — source-level certain, chip-gated

## Root cause
mps_intr_locked() recomposes the reply pointer from the chip-supplied ReplyFrameAddress
(:1532-1534) and bounds-checks it (:1541-1543):

    if ((reply < sc->reply_frames) ||
        (reply > (sc->reply_frames + (sc->fqdepth * sc->facts->ReplyFrameSize * 4))))
        ... panic ...

The upper bound uses `>`, so reply == reply_frames + fqdepth*ReplyFrameSize*4 — the address exactly
ONE FRAME PAST the last valid frame — passes. Valid reply frames occupy [base, base + (fqdepth-1)*fs);
the allocation (mps_alloc_replies:716-718: ReplyFrameSize * max(fqdepth, num_replies) * 4 == fqdepth
frames) ends at `end`. reply == end is then dereferenced as MPI2_DEFAULT_REPLY* (:1554, :1581-1582)
⇒ OOB read past the DMA map of chip-influenced length (MsgLength drives later reads/prints).

Adjacent to DF-1369 (SMID validation) but a distinct unchecked quantity. Low: requires a controller
that returns exactly the end address.

## Fix
Reject reply >= end - (one frame): the last valid frame START is base + (fqdepth-1)*fs; better,
require frame alignment and reply < end - fs.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.