DF-4016
mps_user_btdh off-by-one: target == max_devices passes the range check and reads mapping_table[max_devices] out of bounds
Summary
The bt2dh range check is 'target > sc->max_devices' but mapping_table is allocated with exactly max_devices entries. TargetID==max_devices passes and reads one 24-byte element past the heap allocation, returning the garbage u16 as DevHandle to the operator-group caller. mpr twin at mpr_user.c:2240 (same '>'). '>=' fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4016 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 209 B | ↓ raw | |
| verdict.json | file | 918 B | view raw |
README.md
file
↓ download raw
DF-4016
Low/Info finding — PoC skipped per contract (hardware-gated / dead code). Source citations in the pass-2 result block.
Fix: change the check to 'target >= sc->max_devices' (and fix the mpr twin)
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
change the check to 'target >= sc->max_devices' (and fix the mpr twin)
source-only
per-fix-DF-4016
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; HW-gated
No comments yet.