DF-3912 — mpt handshake reply walk: negative left from IOC MsgLength==0 → non-terminating polling loop (attach-time livelock)

File: sys/dev/disk/mpt/mpt.c Lines: 1475-1491 (mpt_recv_handshake_reply) Severity: Low (malicious/faulty IOC → driver-attach hang with MPT_LOCK held) — hardware-gated Class: base:dev / CWE-835 (loop with unreachable exit), pass 2 (checklist (f): reply-frame walks beyond the known set)

Build / Run

./build.sh && ./run.sh

Expected output

MsgLength=0 -> left=-2
loop ran 100000000 iterations and was cut off by the harness ...
trigger rc=1 (1 == non-terminating loop demonstrated)

Root cause

left = (hdr->MsgLength << 1) - 2; (:1475) with the IOC-supplied MsgLength (u8, dwords). For MsgLength < 2 left is negative, and while (left--) (:1477) can never become false (int underflow wraps through INT_MIN). The loop body only exits via mpt_wait_db_int() failure — 300000 × DELAY(100) = up to 30 s of spinning per attempt — so a malicious IOC that keeps the doorbell interrupt asserted pins the attach thread in a livelock holding MPT_LOCK (boot hang). Bounded-write side is safe (if (reply_left-- > 0)), so this is purely the loop-exit defect.

Fix

fix.diff clamps left < 0 to 0 (skip the remainder walk). Validated in the batch nativekernel rebuild: mpt.c compiled in-kernel and as module with -Werror, rc=0 (fix_build.log).

DF-3912 — Verification Verdict

Status: not_reproduced (reproduced=0) Impact: none on guest (no MPT HBA present) Confidence: certain (source-level)

Finding

mpt_recv_handshake_reply() computes left = (hdr->MsgLength << 1) - 2 from the IOC-authored reply header (first two doorbell words, :1450-1461) and loops while (left--) (:1475-1477). MsgLength ∈ {0,1} yields left = -2 or 0; for -2 the post-decrement condition never terminates (int wrap), so the loop exits only when mpt_wait_db_int() times out — up to MPT_MAX_WAIT(300000) × 100 µs per attempt — and never if a malicious IOC keeps MPT_DB_INTR asserted. The loop runs during attach/init handshakes with MPT_LOCK held → livelock/DoS.

Verification

• Source chain certain (README).
• Guest run (run.log): the harness loop with left=-2 ran 1e8 iterations without exiting and was cut only by the harness bound (the kernel has no such bound); rc=1. The kernel path requires an MPT IOC (absent — env.txt), hence not_reproduced-on-guest (device-gated), consistent with the DF-2481 mpt precedent.

Fix validation

fix.diff: if (left < 0) left = 0; after the subtraction. Applied with the batch; nativekernel rebuild rc=0, mpt.c compiled in-kernel + KLD module with -Werror, 0 errors (fix_build.log). fix_status = fixed (compile-validated).

Negative notes tied to this audit of the walk family

• Write side of the handshake walk is bounded (reply_left-- > 0, :1487).
• mpt_intr handler dispatch is masked: MPT_CONTEXT_TO_CBI ANDs with (MPT_NUM_REPLY_HANDLERS-1) (mpt.h:829-830) → no OOB function-pointer call; req_index is bounds-checked at mpt.c:811.
• tgt_cmd_ptrs access bounded at mpt.c:765-773.
• DF-1280 (address-reply offset) and DF-1281 (EventDataLength) remain the known walk bugs; not re-derived here.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.