# DF-4869 — VERDICT

**Status: untested (no trigger path). Reproduced: 0. Impact: none (latent). Confidence: certain.**

## Why untested

- The audit guest has no LSI (vendor 0x1000) MPT2 controller; the mps driver never
  attaches (env.txt) — so the SAS event path itself cannot run.
- `mps_print_sasdev0` / `mps_print_expander1` / `mps_print_sasphy0` have **zero
  callers tree-wide**; there is no trigger path on any machine.
- The `mps_describe_table` sentinel+1 fallback is in-bounds for every table that
  exists today; the OOB read only materializes for a future non-conforming table.

## Liveness / bounds evidence (grep, tree-wide)

- Callers of `mps_print_evt_sas`: exactly one — `mpssas_evt_handler`
  (`sys/dev/raid/mps/mps_sas_lsi.c:131`), the registered mps event callback; runs on
  every async SAS event. All field reads inside the PHY walk are arguments to
  `mps_dprint_field(sc, MPS_EVENT, ...)`, which compiles to
  `if (sc->mps_debug & MPS_EVENT) kprintf(...)` (`sys/dev/raid/mps/mpsvar.h:609`,
  `:628-632`) — args evaluated only when the debug bit is set (default 0;
  `sc->mps_debug` is settable only via the per-device sysctl, root-only).
- Callers of `mps_print_sasdev0` / `mps_print_expander1` / `mps_print_sasphy0`:
  none (declarations only, `sys/dev/raid/mps/mps_table.h:47-50`).
  Compare: `mps_print_iocfacts` (live, `mps.c:1046`), `mps_print_portfacts`
  (live, `mps.c:1158`), `mps_print_event` (live, `mps.c:1264/:1648/:1724`),
  `mps_print_scsiio_cmd` (live, `mps_sas.c:2063` — see DF-4868).
- Event buffer at the walk: the reply frame inside `sc->reply_frames`
  (`mps.c:1530-1543`), per-frame size `sc->facts->ReplyFrameSize * 4`
  (`mps.c:718`, firmware-reported); `EventDataLength` (dwords) is never used to
  bound the walk at `mps_table.c:332`.
- `mps_describe_table` fallback: `return(table[i+1].string)` at
  `sys/dev/raid/mps/mps_table.c:72` — reads the entry after the `{NULL,0}` sentinel
  that terminated the loop at `:68`. All nine in-file tables carry a trailing
  "Unknown" entry; external callers (`mps_sas_lsi.c:673`) pass conforming tables.

## Exploit chain

None — no reachable path in the shipped tree. Ceiling (if debugging is enabled by
root AND a malicious controller supplies the event): console disclosure of reply-pool
DMA memory past the event frame. Filed as Info hardening, mirroring DF-4790.

## Fix validation

`fix_status: not_testable` — dead/latent code; the diff is a defensive bound plus
cleanup, nothing to exercise on the guest.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.