DF-3583 — Unbounded card-controlled handle count in RIO1 fast-post loop (kernel stack OOB read)

WHAT sys/dev/disk/isp/isp.c:5087-5095, inside isp_intr()'s response-queue loop:

    } else if (etype == RQSTYPE_RIO1) {
            isp_rio1_t *rio = (isp_rio1_t *) qe;   /* uint8_t qe[QENTRY_LEN] */
            isp_get_rio1(isp, (isp_rio1_t *) hp, rio);
            for (i = 0; i < rio->req_header.rqs_seqno; i++) {
                    isp_fastpost_complete(isp, rio->req_handles[i]);  /* OOB */
            }

isp_rio1_t (ispmbox.h:866-871) is exactly QENTRY_LEN = 64 bytes:
a 4-byte isphdr_t plus uint32_t req_handles[15].  rqs_seqno is a full
8-bit byte written by the card (DMA); nothing clamps it to 15.  A card
claiming N > 15 handles makes the loop read (N-15)*4 bytes past the
64-byte kernel-stack buffer — up to 960 bytes of adjacent stack walked,
with each garbage word consumed as a completion handle
(isp_fastpost_complete -> isp_find_xs validates, so the values act only
as lookup keys; a chance match spuriously completes/destroys that
command).

REACHABILITY RIO1 entries only occur when the driver negotiates FW_FEATURE_RIO_32BIT, which the default build does for Ultra3 SCSI cards (isp.c:1360-1361, IS_ULTRA3, ISP_NO_RIO not defined). Requires faulty or malicious HBA firmware to set seqno > 15 — the card is the trust boundary here; this is a robustness defect against bad hardware, not a remotely reachable bug.

PROOF (this pack) trigger_df3583.c runs the identical loop with seqno = 0xff against qe[64] placed flush against a PROT_NONE guard page:

    FAULT (SIGSEGV/SEGV) at 0x80047d000 => 0 bytes past the end of qe[64]
    (loop reached i == 16, array holds 15)

i.e. the very first out-of-array read (i == 16) already leaves the
buffer; with seqno = 0xff the kernel-side loop would keep reading to
qe+1024, 960 bytes past the buffer end.

WHY "inconclusive" Same reason as DF-3582: no QLogic HBA in the guest, so the in-kernel path cannot be exercised. The defect and its bounds are proven from the real kernel headers on the guest compiler.

UPSTREAM Modern FreeBSD removed the RIO1 handling from isp_intr() entirely; the unclamped loop is inherited from the 2011 FreeBSD revision DragonFly carries.

FIX fix.diff — clamp the loop to the array size.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.