# DF-5573 — ppb_MS_init_msq(): instruction index `ins` is never bounds-checked — controlled OOB kernel write of up to ~8 KB from the microsequence array

Severity: Low · Confidence: certain · File: sys/bus/ppbus/ppb_msq.c (pass 2)

## Reproduce

1. `sh build.sh` — compiles the verbatim production `ppb_msq.c` into `msqhx.ko`
2. `sh run.sh` — case 0 (non-fatal)
3. Observe dmesg (`dmesg | grep MSQHX`) / the serial console.

### Expected
BASELINE (unfixed): 'OOB ins=60 ... CONTROLLED WRITE LANDED' and 'OOB ins=200 ... CONTROLLED WRITE LANDED' — kernel memory outside the caller's array is written with fully controlled 4/8-byte values. PATCHED: in-bounds init still works; ins=200 (>= PPB_MS_MAXLEN) fails fast with 'panic: ppb_MS_init_msq: instruction out of range (200)' before any write.

## Harness (shared by DF-5573..DF-5577)

`msqhx.c` + `Makefile` compile the **verbatim production**
`/usr/src/sys/bus/ppbus/ppb_msq.c` (sha256 223e7f9184c81ab83f49228ae7d1f99a
6e3936b9a452b01c6bb6176b150dda67, identical to the repo `sys/` copy) into a
KLD, together with a fake ppbus controller on nexus whose
`ppbus_exec_microseq` method implements the exact dispatch semantics of
`ppc_exec_microseq()` (sys/dev/misc/ppc/ppc.c:1332-1542) for the exercised
opcodes.  The interpreter target device's softc is a real `struct ppb_data`
and its child's ivars are a real `struct ppb_device`, so `mode2xfer()`,
`ppb_MS_init()`, `ppb_MS_exec()`, `ppb_MS_microseq()`, `ppb_MS_loop()` and
`ppb_MS_init_msq()` all run their production code paths.  Evidence class:
"KLD-harness-with-production-code" (no parallel port in the QEMU rig) —
family standard, cf. DF-5418.

## Build

    # inside the guest, from this directory
    sh build.sh          # -> /tmp/msqhx-build/msqhx.ko

## Run

    sh run.sh            # runs this pack's case via sysctl hw.msqhx_case
    sh run.sh <case>     # 0=suite(5575+5573) 2=5574 4=5576a 5=5576b 6=5577

Cases 2/4/5 PANIC the guest on unfixed production code (that is the finding);
the panics land on the serial console (`dfbsd-qemu/vm.sh log`).

## Fix validation

`fix.diff` (sha256 8e3dfc90e6049ce1704c3cef833cba0904b6404f11360bdd299e37980e9327bb) patches `sys/bus/ppbus/ppb_msq.c` +
`sys/bus/ppbus/ppbconf.h` (all five findings; never applied to the repo's
read-only `sys/` tree).  Validation procedure: copy the fixed files into the
guest's `/usr/src/sys/bus/ppbus/`, `sh build.sh` again (recompiles the
production source), re-run the same case.  Baseline vs patched outputs are
in `run.log` / `fix_run.log` (plus `panic*.txt` / `fix_run.log` for the
fatal cases).