# DF-4790 VERDICT

* **Status:** untested (latent / dead code)
* **Confidence:** certain (dead-code status and loop bodies verified by direct read + tree-wide grep)
* **Severity filed:** Info

## Evidence

Liveness check (tree-wide, `rg` over `sys/`): the only callers of any `mpr_print_*`
symbol outside `mpr_table.c` are

* `mpr_sas.c:2814` → `mpr_print_scsiio_cmd` (live; covered by DF-4789)
* `mpr_sas_lsi.c:967,1381` → `mpr_describe_devinfo` (live; bounded `ksnprintf` into an
  80-byte stack buffer — checked safe)

`mpr_print_evt_sas`, `mpr_print_evt_generic`, `mpr_print_iocfacts`,
`mpr_print_portfacts`, `mpr_print_sasdev0`, `mpr_print_expander1`, `mpr_print_sasphy0`
have **zero callers**. Their latent defects:

1. `mpr_table.c:412-425` — `NumEntries` (firmware byte) drives `data->PHY[i]` with no
   `EventDataLength` bound. Compare the *live* twins already filed in pass 1:
   DF-1474 (`mpr_sas_lsi.c` topo/IR/PCIe walks), DF-3919 (`mpr_mapping.c` element
   counts), DF-4560 (mps `mpssas_fw_work` fixed-offset reads). Same class, currently
   unreachable.
2. `mpr_table.c:72` — `table[i+1].string` relies on every table shipping an extra
   entry after the `{NULL,0}` sentinel; all 13 do today (line refs in README), so this
   is convention-fragility, not a live OOB.

## Why Info and not higher

Both arms require the dead code to be wired up first. No reachable path exists on any
configuration, hardware or otherwise; nothing to execute on the guest.

## Recommended fix summary

Bound the `NumEntries` walk by the event-frame length (fix.diff) — or better, delete the
dead printers; replace `table[i+1].string` with a literal `"unknown"` fallback or
bounds-check `i+1`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.