{
  "finding_id": "DF-4089",
  "status": "untested",
  "reproduced": 0,
  "impact": "OOB read (up to ~2KB) of kmallocd event frame; garbage feeds mapping engine (kernleak-class, no direct copyout traced)",
  "confidence": "likely",
  "verdict": "Low - PoC skipped per contract (hardware-gated, mpr twin DF-3919 precedent). The mapping engine walks event arrays by their independent count fields with no frame-length bound: mps_mapping_topology_change_event :2058 walks PHY[NumEntries] (U8, 4B each) and mps_mapping_ir_config_change_event :2161/:2187 plus _mapping_check_update_ir_mt_idx :2105 walk ConfigElement[NumElements] (U8, 8B each), while the backing buffer is kmalloc(EventDataLength*4) (mps_sas_lsi.c:141). A firmware frame whose count exceeds its length over-reads up to ~1KB/~2KB past the allocation; read handles/reasons then drive missing-count updates, device adds and removal bookkeeping. Also noted: sz = EventDataLength*4 is a u16 computation that wraps to 0 at 0x4000. Fix (producer-side allocation floor + u32) authored; module compile-validated with the batch.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (walks + buffer provenance), fix.diff (mps_sas_lsi.c), fix_build.log in DF-4085 pack",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_mapping.c:2043",
    "sys/dev/raid/mps/mps_mapping.c:2058",
    "sys/dev/raid/mps/mps_mapping.c:2105",
    "sys/dev/raid/mps/mps_mapping.c:2161",
    "sys/dev/raid/mps/mps_mapping.c:2187",
    "sys/dev/raid/mps/mps_sas_lsi.c:141"
  ],
  "poc_changes": "n/a (untested)",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "mps twin of DF-3919. Fix intentionally placed in mps_sas_lsi.c (producer owns the frame length).",
  "recommended_fix": "Floor the fw_event->event_data allocation at the maximum walk extent implied by the events own NumEntries/NumElements (and widen sz to u32) in mpssas_evt_handler.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Applied to the guest /usr/src together with this batchs other mps fixes (DF-4085..DF-4090); make in sys/dev/raid/mps compiled all sources with -Werror and linked mps.ko (BUILD_EXIT=0). Runtime fix validation not testable: the path requires an mps(4) HBA delivering firmware data, absent on this guest.",
  "fix_evidence": "findings/poc/DF-4089/fix.diff, findings/poc/DF-4085/fix_build.log"
}