# DF-4090 VERDICT

**Status:** untested — hardware-gated (no mps HBA on the audit guest,
`env.txt`); Low-severity truncation with proven-benign direction, PoC not
meaningful. **Confidence:** certain (arithmetic + copy bound verified).

- Truncation: `mps_mapping.c:1721` declares `uint16_t dpm_pg0_sz`;
  `:1774-1776` assigns `8 + max_dpm_entries * sizeof(entry)` where
  `sizeof(MPI2_CONFIG_PAGE_DRIVER_MAP0_ENTRY) == 20`
  (`mpi2_cnfg.h:2721-2730`: 8+2+2+4+4). For `MaxPersistentEntries ≥ 3277`
  the value exceeds 65535 and wraps; the wrapped (smaller) size is passed to
  `mps_config_get_dpm_pg0` at `:1780-1781`.
- Allocation side is correct: `mps_mapping_allocate_memory:1391,1418-1421`
  computes in `uint32_t`; buffer is always ≥ the truncated read size.
- Copy safety: `mps_config.c:541` `memset(config_page, 0, sz)` (sz ≤ alloc)
  and `mps_config.c:635` `bcopy(page, config_page, MIN(cm->cm_length, sz))`
  — bounded by sz. Under-read only. (Had the copy been bounded by
  `cm->cm_length` — firmware `ExtPageLength` — this would instead be a heap
  overflow; the `MIN()` is the load-bearing guard and is present.)
- Effect: DPM entries beyond ~index 3275 remain zero → treated as unused at
  `_mapping_process_dpm_pg0:1486-1488` → persistent mapping silently lost,
  re-derived from topology events. Functional impact only.
- Fix: `fix.diff` widens the local and the `sz` parameter (definition
  `mps_config.c:529-531`, declaration `mpsvar.h:718-719`) to `u32`.
  Compile-validated: applied to guest `/usr/src` with the batch's mps fixes;
  `make` in `sys/dev/raid/mps` with `-Werror` linked `mps.ko`
  (BUILD_EXIT=0; `fix_build.log` in the DF-4085 pack). `/usr/src` restored
  pristine; guest reset with clean-source snapshot.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.