# VERDICT — DF-4213

**status: untested (hardware-gated) · impact: low-value kernel/DMA info leak to console + broken feature · confidence: certain (source)**

Not runnable on the audit guest (no LSI MPT hardware; `env.txt`). Source
proof is complete:

- `struct mpt_raid_action_result.action_data` union: max member
  `MPI_RAID_VOL_INDICATOR` = `U64 TotalBlocks; U64 BlocksRemaining;` = 16
  bytes (`sys/dev/disk/mpt/mpilib/mpi_raid.h`, `_MPI_RAID_VOL_INDICATOR`).
- `MSG_RAID_ACTION_REPLY` ends at 0x1C with `U32 ActionData` at 0x18 — 4
  bytes (same header, `_MSG_RAID_ACTION_REPLY`).
- `memcpy(..., sizeof(action_result->action_data))` at
  `mpt_raid.c:578-581` copies 16 bytes from a 4-byte field → 12 bytes
  over-read. Physically it stays inside the 256-byte reply frame
  (`MPT_REPLY_SIZE`, `mpt.h:816`), so no heap OOB — it reads stale
  reply-frame residue.
- The producer passes `addr=0, len=0` (`mpt_raid.c:1327`), so no SGE buffer
  exists for the indicator; the reply frame is the only source — guaranteeing
  the printed `sync_progress` (`mpt_raid.c:1336-1343`) contains 12 stale
  bytes, printed at `mpt_raid.c:1521-1536`.

Impact ceiling: console/dmesg disclosure of stale IOC reply bytes (previous
replies in that frame slot — transfer counts, event data, config echoes), no
kernel pointers. Low severity, certain mechanism. Fix bounded-copy diff
provided; not runtime-validated (no hardware) → `fix_status: not_testable`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.