# DF-4390 — NULL request-descriptor dereference in mfi_tbolt_send_frame()

**File:** `sys/dev/raid/mfi/mfi_tbolt.c:1156-1168` (fall-through), deref at `:1181-1182`
**Severity:** Medium · **Confidence:** certain (static) · runtime test requires TBOLT hardware

## Build

```sh
cc -O -Wall -o df4390 df4390_trigger.c        # verified on the DF guest
```

## Run

```sh
./df4390 /dev/mfi0                            # or let it try the
                                              # /dev/megaraid_sas_ioctl_node alias
```

## Expected

On a system with a Thunderbolt (LSI 2108/2208 family, `MFI_FLAGS_TBOLT`,
so `MFA_enabled == 1`) megaraid controller:

* **via this ioctl** (root or operator group, `/dev/mfi0` is 0640
  root:operator): `MFIIO_PASSTHRU` with `header.cmd = MFI_CMD_PD_SCSI_IO`
  (0x02) and `mbox[4] = 0x28` (aliases `pass.cdb[0] = READ_10`) makes
  `mfi_user_command()` (mfi.c:2838 bcopy of the whole user frame) hand the
  frame to `mfi_tbolt_send_frame()`, which takes the
  `cdb[0] == 0x28` else-branch, prints `DJA NA XXX SYSPDIO`, leaves
  `req_desc == NULL`, and then executes
  `MFI_WRITE4(sc, MFI_ILQP, (req_desc->words & 0xFFFFFFFF));`
  → **immediate kernel panic** (read fault at ~address 0).
* **without any ioctl at all:** every read/write bio to a *system PD*
  (JBOD drive exposed to the host) builds exactly this frame
  (`mfi_build_syspdio()`, mfi.c:1992-2001: `pass->header.cmd =
  MFI_CMD_PD_SCSI_IO; pass->cdb[0] = READ_10/WRITE_10`), so mounting or
  fsck'ing a JBOD disk on a TBOLT card panics instantly. Crash dumps to a
  system PD hit the same path (`mfi_dump_syspd_blocks()`, mfi.c:2453-2461).

## Observed on this audit's QEMU guest (honest negative)

The guest kernel (`X86_64_GENERIC`, DragonFly 6.5-DEVELOPMENT) has the mfi
driver compiled in, but the guest has **no LSI PCI device at all** (virtio
only), so no `/dev/mfi0` exists and `mfi_tbolt_send_frame()` can never run:

```
$ kldload mfi
kldload: can't load mfi: module already loaded or in kernel
$ ls /dev/mfi*
ls: /dev/mfi*: No such file or directory
$ ./df4390
[-] open(/dev/mfi0): No such file or directory ...
```

The defect itself is proven statically end-to-end (see VERDICT.md).
QEMU's `megasas` emulation models the 1078/Gen2 chips — which take the
non-TBOLT `mfi_send_frame()` path — not the Thunderbolt 2108/2208, so no
QEMU configuration can reach this code.