DF-4090 — dpm_pg0_sz truncated to u16 in mps_mapping_initialize — DPM page silently under-read (integer truncation, benign direction proven)

File: sys/dev/raid/mps/mps_mapping.c:1721,1774-1789 (+ u16 sz parameter plumbing in mps_config.c:529-531 and mpsvar.h:718-719) Class: CWE-197 integer truncation (checklist item (d): persistent mapping config page copy sizes vs kmalloc) Severity: Low — pass 2 (GLM 5.3), bucket base:dev Confidence: certain

The bug

uint16_t volume_mapping_flags, dpm_pg0_sz;          /* :1721 — u16! */
...
dpm_pg0_sz = sizeof(MPI2_CONFIG_EXTENDED_PAGE_HEADER) +
    (sc->max_dpm_entries *
     sizeof(MPI2_CONFIG_PAGE_DRIVER_MAP0_ENTRY));   /* :1774-1776: 8 + 20*N */
retry_read_dpm:
        if (mps_config_get_dpm_pg0(sc, &mpi_reply, sc->dpm_pg0,
            dpm_pg0_sz)) {                          /* :1780-1781 */

The allocation in mps_mapping_allocate_memory:1418-1421 computes the size in uint32_t (8 + 20N bytes, N = ioc_pg8.MaxPersistentEntries, U16), but the read* size passed to mps_config_get_dpm_pg0() is held in a u16 and truncates for N ≥ 3277 (8 + 20·3277 = 65548 > 65535). The function's sz parameter is itself u16 (mps_config.c:530, decl mpsvar.h:719).

Direction analysis (why Low, not memory-unsafe)

mps_config_get_dpm_pg0 does memset(config_page, 0, sz) then finishes with bcopy(page, config_page, MIN(cm->cm_length, sz)) (mps_config.c:635) — the copy is always bounded by the truncated (smaller) sz into the full-size M_ZERO allocation, so this can only under-read, never overflow: persistent entries beyond index ~3275 silently read as zero (unused) instead of their NVRAM contents. Impact is functional (DPM persistence silently dropped for large tables; mapping rebuilt from events), requiring a malicious/odd firmware reporting MaxPersistentEntries ≥ 3277 — real HBAs report small values. Worth fixing while the file's bounds are being hardened; not exploitable memory corruption.

Fix

fix.diff (3 files): uint32_t dpm_pg0_sz in mps_mapping_initialize; widen mps_config_get_dpm_pg0's sz to u32 in definition (mps_config.c) and declaration (mpsvar.h). Compile-validated with the batch (-Werror, mps.ko linked — fix_build.log in DF-4085's pack).

DF-4090 VERDICT

Status: untested — hardware-gated (no mps HBA on the audit guest, env.txt); Low-severity truncation with proven-benign direction, PoC not meaningful. Confidence: certain (arithmetic + copy bound verified).

• Truncation: mps_mapping.c:1721 declares uint16_t dpm_pg0_sz; :1774-1776 assigns 8 + max_dpm_entries * sizeof(entry) where sizeof(MPI2_CONFIG_PAGE_DRIVER_MAP0_ENTRY) == 20 (mpi2_cnfg.h:2721-2730: 8+2+2+4+4). For MaxPersistentEntries ≥ 3277 the value exceeds 65535 and wraps; the wrapped (smaller) size is passed to mps_config_get_dpm_pg0 at :1780-1781.
• Allocation side is correct: mps_mapping_allocate_memory:1391,1418-1421 computes in uint32_t; buffer is always ≥ the truncated read size.
• Copy safety: mps_config.c:541 memset(config_page, 0, sz) (sz ≤ alloc) and mps_config.c:635 bcopy(page, config_page, MIN(cm->cm_length, sz)) — bounded by sz. Under-read only. (Had the copy been bounded by cm->cm_length — firmware ExtPageLength — this would instead be a heap overflow; the MIN() is the load-bearing guard and is present.)
• Effect: DPM entries beyond ~index 3275 remain zero → treated as unused at _mapping_process_dpm_pg0:1486-1488 → persistent mapping silently lost, re-derived from topology events. Functional impact only.
• Fix: fix.diff widens the local and the sz parameter (definition mps_config.c:529-531, declaration mpsvar.h:718-719) to u32. Compile-validated: applied to guest /usr/src with the batch's mps fixes; make in sys/dev/raid/mps with -Werror linked mps.ko (BUILD_EXIT=0; fix_build.log in the DF-4085 pack). /usr/src restored pristine; guest reset with clean-source snapshot.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.