DF-3675 — unsigned resid underflow from IOC-supplied TransferCount

Severity: Low (logic/integrity; IOC-driven). ccb->csio.resid is computed as dxfer_len - TransferCount with no clamp (mpt_cam.c:3132-3133): an IOC that over-reports produces resid ~= 4G, visible to pass(4) users and violating CAM invariants for cd/da residual handling. No PoC possible without MPT hardware (env.txt). Shared with upstream FreeBSD. See VERDICT.md.

DF-3675 — VERDICT

status: inconclusive (no MPT hardware on guest; source-certain arithmetic)

Root cause

/* sys/dev/disk/mpt/mpt_cam.c:3131-3133 */
    ccb = req->ccb;
    ccb->csio.resid =
        ccb->csio.dxfer_len - le32toh(scsi_io_reply->TransferCount);

TransferCount is a U32 field of the IOC's DMA'd SCSI_IO_REPLY frame with no clamping: an IOC reporting more bytes transferred than the command's dxfer_len underflows the unsigned subtraction, so CAM and userland see resid near 4 G (dxfer_len - TransferCount mod 2^32). The driver only special-cases TransferCount == 0 under MPI_IOCSTATUS_SCSI_RESIDUAL_MISMATCH (mpt_cam.c:3163-3176); for DATA_OVERRUN (:3198) and every other status the bogus resid flows out untouched.

Consumers: - pass(4) copies the full CCB back to the caller — the huge resid is directly visible to the pass user (correctness/integrity of upper-layer software that trusts resid); - cd(4)/da(4) use resid for residual handling and error reporting; a resid greater than dxfer_len violates CAM's invariant and can mis-drive retry / dump accounting (e.g. da dump residual bookkeeping).

Threat: requires an IOC/firmware reporting a wrong TransferCount (or real overrun reporting) — hardware-trust class. No memory-safety consequence in the driver itself; impact ceiling is wrong data-accounting visible to userland and possibly a wedged dump/retry path. Severity Low.

Fix (also matches the defensive style used for sense data)

--- a/sys/dev/disk/mpt/mpt_cam.c
+++ b/sys/dev/disk/mpt/mpt_cam.c
@@ -3129,7 +3129,13 @@ mpt_scsi_reply_frame_handler(struct mpt_softc *mpt, request_t *req,
    sstate = scsi_io_reply->SCSIState;

    ccb = req->ccb;
-   ccb->csio.resid =
-       ccb->csio.dxfer_len - le32toh(scsi_io_reply->TransferCount);
+   {
+       uint32_t xferred = le32toh(scsi_io_reply->TransferCount);
+       if (xferred > ccb->csio.dxfer_len)
+           ccb->csio.resid = 0;    /* IOC over-reported */
+       else
+           ccb->csio.resid = ccb->csio.dxfer_len - xferred;
+   }

Guest verdict

inconclusive — no MPT hardware; the underflow is proven by inspection (unsigned U32 arithmetic, no clamp) and matches upstream FreeBSD (mpt_cam.c ccb->csio.resid = ccb->csio.dxfer_len - le32toh(scsi_io_reply->TransferCount); — shared bug).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.