# DF-4085 VERDICT

**Status:** not_reproduced (kernel level) — hardware-gated; **primitive proven
at object level on the audit guest** (userland harness, verbatim loop).
**Confidence:** certain (source arithmetic) / the OOB write itself is proven
by the harness; only the in-kernel execution is gated by absent hardware.

## Source chain (line-by-line)

1. `sys/dev/raid/mps/mps.c:1228` `mps_startup()` → `mps_mapping_initialize(sc)`
   (return ignored — moot here: with `M_INTWAIT` allocations it cannot fail).
2. `mps_mapping.c:1739-1740` `max_dpm_entries = ioc_pg8.MaxPersistentEntries`;
   `is_dpm_enable = !!max_dpm_entries` — DPM active on any non-zero value.
3. `mps_mapping.c:1774-1793` DPM pg0 read into `sc->dpm_pg0`
   (`kmalloc(8 + 20*max_dpm_entries)`, `:1418-1421`) and
   `_mapping_process_dpm_pg0()` called.
4. `mps_mapping.c:1469` `max_num_phy_ids = le16toh(ioc_pg8.MaxNumPhysicalMappedIDs)`
   — u16, firmware field, grep confirms no validation against `max_devices`
   anywhere in the driver.
5. `mps_mapping.c:1512-1518` ENCLOSURE_SLOT_MAPPING branch:
   `dev_idx < num_rsvd_entries + max_num_phy_ids` ⇒ `num_slots =
   max_num_phy_ids` (u16, up to 65535). Else-branch `num_slots` ≤ 0xF
   (4-bit slot field) — bounded.
6. `mps_mapping.c:1544-1563` `mt_entry = &sc->mapping_table[dev_idx];`
   `for (map_idx = dev_idx; map_idx < dev_idx + num_slots; map_idx++,
   mt_entry++)` — writes `physical_id` (fw 64-bit), `phy_bits`, `channel`,
   `id`, `dpm_entry_num`, `missing_count`, `device_info` per entry.
   **No check that `dev_idx + num_slots <= max_devices`.**
7. `mps_mapping.c:1393-1394` `mapping_table = kmalloc(sizeof(struct
   dev_mapping_table) * max_devices)` = 32 bytes/entry (verified: harness
   prints sizeof == 32 on amd64).

Overflow condition: `dev_idx + max_num_phy_ids > max_devices` with `dev_idx`
itself in bounds (e.g. MaxTargets=508, MaxVolumes=2 ⇒ max_devices=510;
MaxNumPhysicalMappedIDs=0xFFFF; dev_idx=0x100). Result: 65,281 entries × 32 B
= **2,088,992 bytes** written past a 16,320-byte heap allocation at attach
time, fully deterministic, contents firmware-chosen.

Distinct from the known findings:
- **DF-1374** = unvalidated *DeviceIndex* (index OOB) at the same function —
  fixed by bounding `dev_idx`; the count stays unbounded, and with
  `num_slots == 0` (slot-field 0) DF-1374's loop never even writes. This
  finding is the *count* (MaxNumPhysicalMappedIDs), reachable with a fully
  in-bounds index.
- **DF-1375** covers (a) `slot - start_slot` underflow in
  `_mapping_add_new_device:1165` and (b) the *event*-`NumSlots` reservation
  loop `_mapping_get_dev_info:992-998`. Neither is DPM-pg0 ingestion.

## Verification performed

- Guest `pciconf -l` (env.txt): virtio-only PCI bus, no SAS HBA ⇒ `mps_attach`
  never runs; kernel-level reproduction impossible on this target (same gate
  as DF-1374/DF-1375/DF-3914; the guest is otherwise intentionally
  exploitation-permissive — no SMAP/SMEP/KASLR).
- `harness_df4085.c` built and run as the unprivileged user on the guest
  (`cc 8.3`), verbatim struct + loop; decisive output in `run.log`; rerun in
  `run.2.log` (identical). Canary 0x5141524153534141 lands at offset 0 of
  every 32-byte slot past the table end — in-kernel equivalent: fw-controlled
  qword at 32-byte stride over adjacent kmalloc zones (slab metadata,
  neighboring objects).
- `fix.diff` applied to the guest `/usr/src` (with DF-4086's clamp and the
  other mps fixes of this batch); `make` in `/usr/src/sys/dev/raid/mps`
  compiled `mps_mapping.c` with `-Werror` and linked `mps.ko`
  (BUILD_EXIT=0) — `fix_build.log`. Guest `/usr/src` then restored pristine
  (reverse-patch verified) and the guest reset with the clean-source
  snapshot.

## Exploitability ceiling (hardware-gated chain)

malicious/compromised IOC firmware or emulated HBA (PCI passthrough) →
DPM pg0 entry + IOC pg8 MaxNumPhysicalMappedIDs → boot-time
`_mapping_process_dpm_pg0` → linear 2 MB heap overwrite with fw-chosen
qwords at stride 32 → adjacent slab-object corruption (e.g. function-pointer
-bearing structures) → kernel code execution. Blocked here only by absent
hardware, not by guest hardening.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.