DF-3874 — Firmware-controlled counts drive list walks past fixed arrays (heap OOB reads)

The controller DMA-writes these list headers; the driver trusts the counts as loop bounds against fixed-size arrays / fixed allocations:

• mfi.c:1331-1341 & 1346-1347 (mfi_syspdprobe): for (i = 0; i < pdlist->count; i++) pdlist->addr[i]... struct mfi_pd_list is addr[MAX_SYS_PDS=240] (mfireg.h:1148-1152) — a firmware count > 240 walks past the kmalloc'd buffer.
• mfi.c:1396-1401 (mfi_ldprobe): for (i = 0; i < list->ld_count; i++) list->ld_list[i]... struct mfi_ld_list is ld_list[MFI_MAX_LD=64] (mfireg.h:1176-1184).
• mfi.c:1770-1788 (mfi_parse_entries, AEN replay at boot): for (i = 0; i < el->count; i++) ... el->event[i] and seq = el->event[el->count - 1].seq + 1; the buffer is sizeof(mfi_evt_list) + sizeof(evt_detail)*(MAX_EVENTS-1) = 15 events (mfi.c:1707-1709, MAX_EVENTS=15 at :1692); count > 15 reads OOB heap and copies the contents into the event queue, which mfi_decode_evt() prints to the console — heap-content disclosure to dmesg/console plus potential fault when walking off the allocation.

All three are the mfi(4) twins of the mrsas reply/list findings; gated on a misbehaving or compromised controller (or anything with DMA access to those buffers), not on unprivileged users.

DF-3874 VERDICT — inconclusive (hardware-gated), likely

• Bounds mismatch verified in source: counts are u32/u16 DMA fields, arrays are 240 / 64 / 15 entries; no clamp anywhere on the paths.
• No user-triggerable input reaches the counts without the firmware writing them; requires a faulty/hostile controller -> Low severity, hardware-gated.
• Impact if it fires: heap OOB read + console info leak (event description bytes), possible fault on the tail reads (allocation boundary).
• fix.diff clamps all three counts.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.