# DF-4093 — mpr _mapping_get_ir_maprange off-by-one: end_idx == max_devices → OOB reads + two 32-byte OOB write sinks (mpr twin of DF-4086)

**File:** `sys/dev/raid/mpr/mpr_mapping.c` (:241-255 range; `<=` walks :387, :430, :484, :2261, :2708; event write :3082-3088; kmalloc :2140-2141; facts :2564-2565)

## Build

```
cc -O2 -Wall -o harness_df4093 harness_df4093.c
```
(DragonFly base cc 8.3; any unprivileged user; runs entirely in userland)

## Run

```
./harness_df4093
```

## Expected output (decisive lines)

```
  sizeof(dev_mapping_table) : 32 (expect 32 on amd64)
  facts: MaxTargets=0 MaxVolumes=255 -> max_devices=255 (:2565)
  valid mapping_table indices: 0..254 (kmalloc 8160 bytes :2140)
  IR maprange: start=1 end=255  (end == max_devices => OFF-BY-ONE: `<=` walks hit index 255)
  wwid walk :387 read physical_id at mapping_table[255] -> OOB READ
  free-idx walk :484 returned 255 (== max_devices, OUT OF BOUNDS)
  event write: mapping_table[255] = {wwid 0x57119418badb00b5, handle 0x0b1d, info 0x30000000}
  guard[255].physical_id == fw WWID: 32-byte heap OOB WRITE at index max_devices
  DPM volume branch :2261 accepted DeviceIndex 255 == end_idx -> second 32-byte OOB WRITE
RESULT: OFF-BY-ONE OOB READS + TWO 32-BYTE OOB WRITES PROVEN
```

Exit code 0 = primitive proven. `run.log` / `run.2.log` hold two identical
guest runs.

## What this proves

Object-level proof of the off-by-one and both write sinks: with firmware
facts `MaxTargets==0` + pg8 `RESERVED_TARGETID_0` + low volume mapping,
`end_idx = start_idx + max_volumes - 1 == max_devices`; every inclusive
IR walk then touches `mapping_table[max_devices]` (OOB read),
`_mapping_get_free_ir_mt_idx` can **return** the OOB index, and
(a) `mpr_mapping_ir_config_change_event` writes a full firmware-controlled
entry there on a volume-add event, and (b) the DPM-pg0 volume branch writes
one there for a `DeviceIndex == end_idx` persistent entry.

## Kernel-level status

Not reproducible on the audit guest: no SAS HBA on the PCI bus (env.txt), so
`mpr_attach` never runs. Same hardware gate as DF-4086 (mps) and
DF-3914/DF-3915 (mpr). Threat actor: malicious/buggy IOC firmware or a
PCI-passthrough/emulated HBA.