{"finding_id":"DF-4836","status":"untested","attempts":0,"reproduced":0,"impact":"corruption","confidence":"likely","verdict":"Static/likely (fw-side walk not honestly replicable without the controller): mrsas_passthru validates user_ioc->sge_count<=16 and substitutes kernel addresses into exactly that many SGEs, but the frame shipped to the FW is a verbatim user copy whose own hdr.sge_count byte is never validated or overwritten - a crafted packet (user_ioc->sge_count=1, frame.hdr.sge_count=16) makes the FW consume stale pool memory as SGEs (physical addresses of freed data buffers = device-mediated UAF), and hdr.sge_count=255 reads 2040 bytes of SGL from a 1024-byte frame allocation (past the frame into adjacent kernel DMA memory). Root/operator ioctl surface (same as DF-1917..1919). Clamp-the-shipped-count fix.","exploit_chain":"prior large ioctl leaves stale SGEs in the pooled frame -> crafted packet with low user_ioc count but high frame count -> FW DMAs to/from freed buffers / parses adjacent kernel DMA memory as SGL","evidence":"findings/poc/DF-4836/ (this verdict; README documents the static chain)","kernel_refs":["sys/dev/raid/mrsas/mrsas_ioctl.c:205","sys/dev/raid/mrsas/mrsas_ioctl.c:225-255","sys/dev/raid/mrsas/mrsas.h:1913","sys/dev/raid/mrsas/mrsas.c:2820-2857"],"guest_uname":"","code_hash":""}