# DF-4089 VERDICT

**Status:** untested — hardware-gated (no mps HBA on the audit guest,
`env.txt`); Low-severity OOB-read class, PoC skipped per batch precedent
(mpr twin DF-3919: untested/likely). **Confidence:** likely (arithmetic is
certain; the *reachability* of a length/count mismatch needs a lying IOC,
hence one notch below certain).

- Buffer provenance: `mps_sas_lsi.c:141-145` —
  `sz = le16toh(event->EventDataLength) * 4; kmalloc(sz); bcopy(...)`;
  the count fields are *not* part of that computation.
- Walk 1 (this file): `mps_mapping.c:2043-2063` — `NumEntries` (U8,
  `mpi2_ioc.h:841`) walked over `PHY[]` (4 B/entry from offset 0x0C) →
  ≤ ~1 KB over-read.
- Walk 2: `mps_mapping.c:2155-2187` and `:2187-2260` — `NumElements` (U8,
  `mpi2_ioc.h:701`) over `ConfigElement[]` (8 B/entry) → ≤ ~2 KB over-read;
  `_mapping_check_update_ir_mt_idx:2105-2107` re-walks identically.
- The `kmalloc(sizeof(_map_phy_change) * num_entries)` at `:2053` and
  `kmalloc(sizeof(u64) * NumElements)` at `:2155` are correctly sized for
  the *local* arrays — the over-read is strictly of `fw_event->event_data`.
- Consumed values: `phy_change->dev_handle`/`reason` drive
  `_mapping_update_missing_count:698`, `_mapping_get_dev_info:901`,
  `_mapping_add_new_device:1142+`; IR elements drive volume add/remove incl.
  `_mapping_get_ir_mt_idx_from_wwid` matches — i.e. garbage feeds the
  mapping engine's decision inputs (and `mpssas_fw_work`'s parallel walk at
  `mps_sas_lsi.c:205-237`).
- No copyout of over-read bytes located → conservative bucket `kernleak`,
  severity Low (matches the mpr twin's calibration).
- Fix `fix.diff` (producer-side, `mps_sas_lsi.c`): u32 `sz` (also kills the
  `EventDataLength*4` u16 wrap), allocation floored at the walk extent,
  `bcopy` limited to the true frame length. Compile-validated: applied to
  guest `/usr/src` with the batch; `make` in `sys/dev/raid/mps` with
  `-Werror` linked `mps.ko` (BUILD_EXIT=0; `fix_build.log` in the DF-4085
  pack). `/usr/src` restored pristine; guest reset with clean-source
  snapshot.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.