Summary

The size check piop->nInBufferSize+piop->nOutBufferSize > PAGE_SIZE is evaluated in 32-bit unsigned arithmetic because both fields are DWORD (= unsigned int, hptintf.h:748,750). An attacker can choose sizes whose true sum exceeds 2^32 but whose 32-bit-wrapped sum is <= 4096, bypassing the check. The subsequent kmalloc allocates the wrapped (small) size, but copyin uses the original (huge) sizes, producing an unbounded kernel heap overflow.

Root cause

hptproc.c:292:

if (piop->nInBufferSize+piop->nOutBufferSize > PAGE_SIZE) {
    KdPrintE(("User buffer too large\n"));
    return -EINVAL;
}

Both nInBufferSize and nOutBufferSize are DWORD (hptintf.h:748,750 = unsigned int). C performs the addition in unsigned int width, so e.g. nInBufferSize=0x00000FFF (4095) + nOutBufferSize=0xFFFFF001 wraps modulo 2^32 to 0x00000001, which is not > PAGE_SIZE (4096).

hptproc.c:297 then calls:

ke_area = kmalloc(piop->nInBufferSize+piop->nOutBufferSize, M_DEVBUF, M_NOWAIT);

with the same wrapped value 1, returning a minimum-size slab object.

hptproc.c:304:

copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area, piop->nInBufferSize);

is then invoked with the unwrapped nInBufferSize=4095, copying 4095 user bytes into the ~16-byte slab allocation — a 4079-byte kernel heap overflow.

hptproc.c:310 Kernel_DeviceIoControl(... ke_area + piop->nInBufferSize, piop->nOutBufferSize ...) passes a destination pointer far past the allocation and the unwrapped 0xFFFFF001 length, giving every ioctl handler in ioctl.c an OOB write window into adjacent kernel heap.

hptproc.c:315 copyout(ke_area + piop->nInBufferSize, lpOutBuffer, piop->nOutBufferSize) reads OOB from kernel heap into userspace (info leak) if Kernel_DeviceIoControl returns 0.

This bug pattern matches FreeBSD-SA-09:11.hptmv; the DragonFlyBSD copy still ships the buggy unbounded addition.

Threat model & preconditions

• Attacker position: local root (sysctl writes require SYSCAP_NOSYSCTL_WR per kern_sysctl.c:1446 since the OID lacks CTLFLAG_ANYBODY).
• Privileges gained or impact: controlled kernel heap corruption (slab-object overwrite), kernel OOB read into userspace (info leak), and/or panic. In a jail, capability mode, or any model where root is treated as a trust boundary below the kernel, this is root→kernel arbitrary write. Even in single-tenant use it is a trivial DoS.
• Required config or capabilities: device hptmv loaded (the sysctl is always registered via hptregister_node whether or not hardware is present).
• Reachability: sysctl hptmv.status write with a crafted 48-byte HPT_IOCTL_PARAM.

Proof of concept

PoC source: findings/poc/DF-1851/poc_hptmv_heapoverflow.c

Build & run

cc -o poc_hptmv_heapoverflow poc_hptmv_heapoverflow.c
# As root:
./poc_hptmv_heapoverflow

Expected output

kernel: page fault trap, code=0
panic: vm_fault: ... (corrupted slab freelist metadata)

Immediate kernel panic from corrupted slab metadata on the copyin destination or a kfree corruption assert, proving the heap overflow.

Impact

High-severity root→kernel heap overflow. The integer overflow in the size check is trivially exploitable: choose nInBufferSize and nOutBufferSize so their 32-bit sum wraps into [0, 4096]. The kmalloc allocates the wrapped size, but copyin/copyout/Kernel_DeviceIoControl use the original sizes, producing unbounded heap corruption.

Recommended fix

Bound each size individually before the sum, so the sum cannot wrap. Cast to size_t to force 64-bit arithmetic.

--- a/sys/dev/raid/hptmv/hptproc.c
+++ b/sys/dev/raid/hptmv/hptproc.c
@@ -289,7 +289,10 @@ hpt_set_info(int length)
            /*
             * map buffer to kernel.
             */
-           if (piop->nInBufferSize+piop->nOutBufferSize > PAGE_SIZE) {
+           if (piop->nInBufferSize > PAGE_SIZE ||
+               piop->nOutBufferSize > PAGE_SIZE ||
+               (size_t)piop->nInBufferSize + (size_t)piop->nOutBufferSize
+                   > PAGE_SIZE) {
                KdPrintE(("User buffer too large\n"));
                return -EINVAL;
            }

Also pass M_ZERO to the kmalloc (see DF-1852) and check the copyin return value (see DF-1852).

References

• FreeBSD-SA-09:11.hptmv — same integer-overflow pattern in the FreeBSD hptmv driver.
• DWORD type: mvOs.h:62 (typedef unsigned int DWORD).
• HPT_IOCTL_PARAM layout: hptintf.h:748-750.

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).