# DF-4764 — hptmv type confusion in `hpt_get_info` (`goto is_array` passes RAID-1 member *disk*) → kernel SIGFPE panic on unprivileged `sysctl hptmv.status` read

File: `sys/dev/raid/hptmv/hptproc.c` (pass 2)
Bucket: local DoS (panic) via world-readable sysctl; secondary adjacent-memory misparse.

## What this pack contains

- `h1_harness.c` — KLD harness built on the audit guest against the **real**
  driver headers (`<dev/raid/hptmv/global.h>`). Embeds **verbatim** copies of
  `hpt_copy_array_info` (hptproc.c:402-478), `hpt_copy_disk_info`
  (:372-399), `get_disk_name` (:339-349) and the `hpt_get_info` device-list
  loop (:515-549). CTASSERTs prove the union layout the analysis relies on.
- triggers:
  - `1` = DF-4764 baseline (expect panic)
  - `2` = DF-4765 baseline (expect panic)
  - `3` = DF-4766 baseline (expect overread output)
  - `4/5/6` = fixed variants (fix.diff applied to the copies; expect survival)
- `build.sh` / `run.sh`, `build.log`, `run.log` (H1 panic), `run.2.log`
  (H2 panic), `run.3.log` (H3 overread), `run.fixed.log` (H1F/H2F/H3F),
  `panic.txt`, `env.txt`, `fix.diff`, `manifest.json`, `verdict.json`.

## Build

On the DragonFly guest (kernel source at /usr/src):

    mkdir -p /root/h1 && cp h1_harness.c /root/h1/
    printf 'SYSDIR=\t/usr/src/sys\nKMOD=   h1harness\nSRCS=   h1_harness.c\nCFLAGS+= -I/usr/src/sys\n.include "/usr/src/sys/conf/kmod.mk"\n' > /root/h1/Makefile
    cd /root/h1 && make SYSDIR=/usr/src/sys

## Run

    kldload /root/h1/h1harness.ko
    sysctl h1harness.trigger=1     # DF-4764 baseline: panics the guest
    # after vm.sh reset with-src: reload, then
    sysctl h1harness.trigger=4     # DF-4764 fix: survives

## Expected output (baseline trigger 1, from run.log)

    H1:   bArnMember     = df_on_line    = 1
    H1:   rf_broken      = bit16(dDeRealCapacity) = 0
    H1:   rf_rebuilding  = bit21(dDeRealCapacity) = 1
    H1:   pMember[0]     = Device.mv    = 0xffffffff82607140
    Fatal trap 18: integer divide fault while in kernel mode
    Stopped at hpt_copy_array_info.constprop.3+0x130: divq %rdi,%eax

## Honest scope note

The mechanism (verbatim kernel function, real driver structs, verbatim
call path including the buggy hptproc.c:535 `goto`) is reproduced on the
guest. End-to-end reachability through the *live* sysctl additionally
requires hptmv controller hardware with a RAID-1 array whose source disk
remains listed in `_vbus_p->pVDevice[]` — the exact state the driver's
own comment at hptproc.c:530-533 describes. No hptmv controller exists on
the audit guest, so the live path was verified statically (see
VERDICT.md). The sysctl itself is present and world-readable on the guest
(`hptmv.status`).