DF-3896 — Unsigned resid underflow: csio->resid = cm_length − IOC-supplied TransferCount with no clamp (UNDERRUN path)

File: sys/dev/raid/mps/mps_sas.c (pass 2). Twin of DF-3675 (mpt_cam.c).

What

    case MPI2_IOCSTATUS_SCSI_DATA_UNDERRUN:
        csio->resid = cm->cm_length - rep->TransferCount;   /* mps_sas.c:1943 */

cm->cm_length is u_int (mpsvar.h:231) set from csio->dxfer_len (mps_sas.c:1744); rep->TransferCount is a firmware-supplied U32 taken verbatim from the DMA'd reply frame. If the IOC ever reports TransferCount > cm_length (malformed/compromised controller or firmware bug during error recovery — precisely the environment UNDERRUN replies appear in), the subtraction wraps and csio->resid becomes a huge value (e.g. 0xFFFFFFF0). CAM periphs and userland then believe nearly nothing was transferred. resid is consumed by da(4)/cd(4) error handling and exposed via csio → userland (e.g. pass(4) CAM IOCBs); a bogus huge resid corrupts data-integrity decisions rather than memory.

Sibling reference: DF-3675 fixed the identical pattern in mpt_cam.c by clamping. The DATA_OVERRUN case in the same function sets resid = 0 (mps_sas.c:2083) and the default path sets resid = cm_length (mps_sas.c:2114) — only the UNDERRUN path does unchecked arithmetic.

Build/run

run.sh records the hardware gate.

Fix

Clamp: csio->resid = (rep->TransferCount < cm->cm_length) ? cm->cm_length - rep->TransferCount : 0; (see fix.diff).

DF-3896 — VERDICT

Status: not_reproduced (hardware-gated) — defect certain from source, exploitation requires a misbehaving IOC. Impact class: data-integrity/logic confusion from a wrapped CAM resid (Low).

Proof chain

1. sys/dev/raid/mps/mps_sas.c:1943 — csio->resid = cm->cm_length - rep->TransferCount; with no ordering check.
2. cm->cm_length is u_int (sys/dev/raid/mps/mpsvar.h:231) set from the CCB (mps_sas.c:1744); rep->TransferCount is a little-endian U32 copied out of the controller's DMA'd reply frame, unvalidated anywhere on this path.
3. csio->resid semantics: bytes not transferred. CAM consumers (da/cd periph error recovery, camcontrol, pass(4) users) treat resid > dxfer_len as nonsense at best and as "nothing transferred" at worst; a wrapped value near UINT_MAX can drive wrong retry/sense decisions.
4. Same-file contrast: DATA_OVERRUN forces resid=0 (mps_sas.c:2083) and the generic-error path forces resid=cm_length (mps_sas.c:2114) — both clamped; only UNDERRUN does open arithmetic. Twin: DF-3675 (mpt_cam.c:3132-3133), accepted Low with the same clamp fix.

Why not reproduced

Requires an mps controller (none in guest — env.txt/run.log) and an IOC that reports TransferCount beyond the requested length in an UNDERRUN reply. Cannot be driven by unprivileged input on healthy firmware; hence Low severity / hardware+firmware gated.

Fix validation

Not testable on this guest; fix.diff is a two-line clamp identical in spirit to the DF-3675 fix.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.