DF-4213 / fix.diff
--- a/sys/dev/disk/mpt/mpt_raid.c +++ b/sys/dev/disk/mpt/mpt_raid.c @@ -576,8 +576,15 @@ break; } action_result = REQ_TO_RAID_ACTION_RESULT(req); + /* + * MSG_RAID_ACTION_REPLY.ActionData is a single U32. Copying + * sizeof(union action_data) (16, MPI_RAID_VOL_INDICATOR) read 12 + * bytes of stale reply-frame residue past the reply message. + * The full indicator is returned via the ActionDataSGE buffer, + * never inline in the reply frame. + */ memcpy(&action_result->action_data, &reply->ActionData, - sizeof(action_result->action_data)); + sizeof(reply->ActionData)); action_result->action_status = le16toh(reply->ActionStatus); return (TRUE); } |