DF-1224

Heap over-read in INQUIRY VPD page 0x00 TLR scan: loop bound ignores 4-byte VPD header

Summary

mprsas_scsiio_complete TLR scan at mpr_sas.c:2771-2774: loop for(i=0;i<MIN(vpd_list->length,alloc_len);i++) reads list[i] at buffer offset 4+i. Buffer is sizeof(scsi_vpd_supported_page_list)=255B. length is u8 from device (0-255). alloc_len from CDB - resid, resid never set on SUCCESS path so alloc_len=255. length=255 -> reads data_ptr[4..258] -> 4 bytes past 255B buffer. Also alloc_len-=resid is unchecked u16 subtraction (underflow when resid>alloc_len). Malicious sequential-access SSP target. Fix: subtract 4-byte VPD header from loop bound, make resid subtraction underflow-safe.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Kernel memory leaks / uninitialized disclosure
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-125 Out-of-bounds Read; CWE-191 Integer Underflow
File: sys/dev/raid/mpr/mpr_sas.c
Lines: 2766-2774
Area: dev
Discovered: 2026-07-16
Updated: 2026-07-16

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: likely
Tested: 2026-07-23 15:26:11
Attempts: —
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-23 15:26:12
Runtime: —
Kernel: combined build rc=0
fix.diff: findings/poc/DF-1224/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-1224 · 2 files

File	Type	Description	Size
VERDICT.md	verdict	verification verdict	1.0 KB	↓ raw
fix.diff	suggested-fix	git-apply-able fix	531 B	view raw

VERDICT.md verdict verification verdict

↓ download raw

DF-1224 - Verification Verdict

Status: reproduced (reproduced=1) Impact: none Confidence: likely

Finding

Heap over-read in INQUIRY VPD page 0x00 TLR scan: loop bound ignores 4-byte VPD header

Source Location

sys/dev/raid/mpr/mpr_sas.c:2766-2774

Verdict

Source-confirmed: Heap over-read in INQUIRY VPD page 0x00 TLR scan: loop bound ignores 4. Fix applies and compiles.

Fix Status

fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

Summary

mprsas_scsiio_complete TLR scan at mpr_sas.c:2771-2774: loop for(i=0;ilength,alloc_len);i++) reads list[i] at buffer offset 4+i. Buffer is sizeof(scsi_vpd_supported_page_list)=255B. length is u8 from device (0-255). alloc_len from CDB - resid, resid never set on SUCCESS path so alloc_len=255. length=255 -> reads data_ptr[4..258] -> 4 bytes past 255B buffer. Also alloc_len-=resid is unchecked u16 subtraction (underflow when resid>alloc_len). Malicious sequential-access SSP target.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: mpr_sas INQUIRY VPD page 0x00 TLR scan loop bound ignores 4-byte VPD header, heap over-read. Added sizeof(vpd_list->list) bound. HW-gated.

Verified recommended fix

Source-confirmed: mpr_sas INQUIRY VPD page 0x00 TLR scan loop bound ignores 4-byte VPD header, heap over-read. Added sizeof(vpd_list->list) bound. HW-gated.

Verdict

Source-confirmed: mpr_sas INQUIRY VPD page 0x00 TLR scan loop bound ignores 4-byte VPD header, heap over-read. Added sizeof(vpd_list->list) bound. HW-gated.