DF-1917 PoC

Trigger: pass sgl_off = 1020..0xFFFFFFFF and sge_count = 1..16 in an MRSAS_IOC_FIRMWARE_PASS_THROUGH ioctl on /dev/mrsas0. The driver writes up to 16 × 8-byte SGE entries (mrsas_sge32 { u32 phys_addr; u32 length; }) at cmd->frame + sgl_off + 8*i without ever checking that sgl_off + 8*sge_count <= MRSAS_MFI_FRAME_SIZE (1024), so the writes spill past the 1024-byte bus_dmamem_alloc'd DMA frame into adjacent kernel heap.

Preconditions

• An LSI MegaRAID SAS HBA present (mrsas_attach creates the cdev).
• /dev/mrsas0 is created mode 0660 root:operator (sys/dev/raid/mrsas/mrsas.c:790-792), so the caller must be root or in the operator group.

Phase-6 hard blocker on this guest. The QEMU audit guest emulates no MegaRAID SAS HBA (verified: pciconf -lv lists none, /dev/mrsas* absent), so mrsas_passthru is unreachable at runtime; and even on a host with the HBA, maxx (uid 1001) is not in operator (verified), so the unprivileged ceiling is "operator-group member". No uid=0 claim — the bug is real, the live path is closed on this guest.

Build

cc -O2 -o harness harness.c

Run

./harness

Expected output

The harness reproduces the verbatim buggy arithmetic of mrsas_ioctl.c:219-255 against a 1024-byte model of cmd->frame and prints, for each (sgl_off, sge_count) test vector, the number of bytes the SGE writes would land past the 1024-byte DMA allocation. In-bounds cases print 0; OOB cases print 4..128 (single SGE) up to 124 (16 SGEs at offset 1020). sgl_off = 0xFFFFFFFF shows the pointer-wrap variant.

Fix

See fix.diff: clamp sgl_off + sge_count * sizeof(struct mrsas_sge32) <= MRSAS_MFI_FRAME_SIZE immediately after reading user_ioc->sgl_off, return EINVAL otherwise.

DF-1917 — Verification Verdict

Verdict: REPRODUCED (source-confirmed + sgl_off-OOB-harness) — Phase-6 hard blocker (no HBA)

The unbounded-sgl_off OOB SGE write is confirmed at sys/dev/raid/mrsas/mrsas_ioctl.c:219-255. The harness reproduces the verbatim buggy arithmetic against a 1024-byte model of cmd->frame and shows that for every attacker-supplied sgl_off that would push sgl_off + 8*sge_count past MRSAS_MFI_FRAME_SIZE, the kernel writes attacker-supplied SGE bytes (phys_addr, length) past the 1024-byte DMA allocation into adjacent kernel heap.

Mechanism

// mrsas_ioctl.h:80-92  -- attacker-controlled u32 fields, no validation
struct mrsas_iocpacket {
    u_int16_t host_no;
    u_int16_t __pad1;
    u_int32_t sgl_off;     // <-- attacker u32
    u_int32_t sge_count;
    ...
};

// mrsas_ioctl.c:219-220  -- u32 offset used verbatim
kern_sge32 = (struct mrsas_sge32 *)
    ((unsigned long)cmd->frame + user_ioc->sgl_off);

// mrsas_ioctl.c:225-255  -- up to 16 SGEs written at frame+sgl_off+8*i
for (i = 0; i < user_ioc->sge_count; i++) {
    ...
    kern_sge32[i].phys_addr = (u_int32_t)ioctl_data_phys_addr[i];
    kern_sge32[i].length    = user_ioc->sgl[i].iov_len;
}

cmd->frame is bus_dmamem_alloc'd at exactly MRSAS_MFI_FRAME_SIZE (=1024 bytes; mrsas.h:876, mrsas.c:451-462). mrsas_sge32 is 8 bytes (mrsas.h:1883-1886, #pragma pack(1)). MAX_IOCTL_SGE=16 (mrsas_ioctl.h:66). So a single ioctl can land up to 16×8 = 128 bytes of attacker-offset writes; with sgl_off=0x3FC and sge_count=16, 124 of those bytes go past byte 1024.

sge_count IS bounds-checked at mrsas_ioctl.c:186 (≤ 16), but sgl_off is never validated anywhere.

Harness evidence (run.log)

DF-1917: mrsas_passthru unbounded sgl_off (mrsas_ioctl.c:219-255)
  sgl_off=0x00000080 sge_count= 1 -> 0 OOB bytes (in-bounds)
  sgl_off=0x000003f8 sge_count= 1 -> 0 OOB bytes (in-bounds)
  sgl_off=0x000003fc sge_count= 1 -> 4 OOB bytes (OOB WRITE past 1024-byte frame)
  sgl_off=0x00000400 sge_count= 1 -> 8 OOB bytes (OOB WRITE past 1024-byte frame)
  sgl_off=0x000003fc sge_count=16 -> 124 OOB bytes (OOB WRITE past 1024-byte frame)
  sgl_off=0xffffffff sge_count= 1 -> 8 OOB bytes (OOB WRITE past 1024-byte frame)

Why no live trigger / Phase-6 hard blocker

The mrsas cdev is created only by mrsas_attach (sys/dev/raid/mrsas/mrsas.c:790-792):

sc->mrsas_cdev = make_dev(&mrsas_ops, device_get_unit(dev), UID_ROOT,
    GID_OPERATOR, (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP), "mrsas%u",
    device_get_unit(dev));

— and mrsas_attach runs only when the PCI probe finds an LSI MegaRAID SAS HBA (sys/dev/raid/mrsas/mrsas.c:3668-3669: DRIVER_MODULE(mrsas, pci, ...)). The QEMU audit guest emulates no such HBA (verified: pciconf -lv lists none; /dev/mrsas* absent), so mrsas_passthru is unreachable at runtime on this guest. Additionally the node would be mode 0660 root:operator, and maxx (uid 1001) is not in operator (verified: pw groupshow operator ⇒ operator:*:5:root), so the unprivileged ceiling is "operator-group member". Valid Phase-6 hard blocker (per AGENT.md: "...dead/unreachable at runtime on this guest...prove the primitive at the object/harness level...").

Exploit chain

Not applicable on this guest (no HBA → no /dev/mrsas* → no mrsas_passthru call from maxx). On real hardware with the HBA, an operator-group member would have an arbitrary-offset (limited to low-entropy phys_addr/length content) kernel heap write relative to a 1024-byte DMA allocation; on noinv this would be silently corrupting, on default GENERIC (INVARIANTS ON) the slab poison/magic checks in kern_slaballoc.c would likely catch cross-zone reuse and panic (DoS). A full uid=0 chain would require (a) operator-group membership, (b) info-leak of the kernel-heap layout adjacent to cmd->frame, (c) a victim object with a function pointer / ucred * / refcount landing in the spill zone — feasible in principle on real hardware but not demonstrable on this guest.

PoC changes

• Added harness.c: verbatim buggy arithmetic against a 1024-byte frame model; 6 test vectors covering in-bounds, edge, OOB, max-spill, pointer-wrap.
• Added fixcheck.c: models the patched predicate from fix.diff (mrsas_ioctl.c:242-246) and shows it rejects the 4 OOB vectors.
• Added fix.diff: validates sgl_off + sge_count*sizeof(mrsas_sge32) <= MRSAS_MFI_FRAME_SIZE before computing kern_sge32, returning EINVAL otherwise.

Fix validation (Phase 8)

fix.diff was applied as part of a combined patch (with DF-1918 and DF-1919, same file) to /usr/src on the with-src snapshot. Kernel rebuilt cleanly (make -j6 nativekernel KERNCONF=X86_64_GENERIC, NK_DONE rc=0; mrsas_ioctl.o recompiled without warnings). The single-fix kernel installed as /boot/kernel/kernel (sha256 c8c9a25c98bc8e06c300820f141d8d1a3e89dcda21c7d2585b36bf8ddb72f064) and booted successfully as DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 20:05:20 UTC 2026. The harness re-ran on the patched kernel (system healthy).

Because /dev/mrsas0 does not exist on this guest, the kernel-side fix could not be exercised via the live syscall path. fixcheck.c models the patched predicate directly: it rejects 4/6 vectors (the 4 that caused OOB), accepts the 2 in-bounds vectors — proving the patched predicate closes the OOB inputs.

• baseline (#0 5dc83dac…): harness shows 4 vectors with OOB write.
• patched (#1 c8c9a25c…): harness unchanged (it is a userspace model); fixcheck shows the same 4 vectors now REJECTED (EINVAL).

fix_status: fixed — the patched predicate provably rejects every input vector that previously caused an OOB write, and the patched kernel is bootable and stable.