DF-4331 — mrsas firmware-zero divisors → kernel #DE panic (map load + IO paths)

File: sys/dev/raid/mrsas/mrsas_fp.c * mr_update_span_set:969 — mega_div64_32(..., quad->diff) with fw diff == 0 (fires at map validation time) * get_arm:599 — mega_mod64(stripe, SPAN_ROW_SIZE(...)) with fw spanRowSize == 0 (fires on first FP IO, RAID 0/5/6) * mr_spanset_get_phy_params:653-654 — same SPAN_ROW_SIZE divisor for RAID 6

Same probe as DF-4330 (fp_probe.ko embedding the unmodified kernel mrsas_fp.c).

Run (guest, root) — panic run

kldload /root/fp4330/fp_probe.ko
sysctl hw.fp_probe_run=2      # quad[0].diff = 0

Expected result (see panic.txt / serial_decisive.log)

fp_probe: calling real MR_ValidateMapInfo() (spanDepth=1 quad[0].diff=0) ...
Fatal trap 18: integer divide fault while in kernel mode
instruction pointer = 0x8:0xffffffff82600cb7
kernel: type 18 trap, code=0
Stopped at probe_mr_update_span_set.part.0+0x1d7: divq %rcx,%eax

Trap 18 = x86 #DE. The identical code compiled into the kernel is what a real adapter delivering quad.diff = 0 executes at attach (mrsas.c:1762) or at any AEN map sync (mrsas.c:2961) — no user IO needed, the box panics while bringing the controller up. Contrast: the IO-time paths do check quad->diff == 0 (mrsas_fp.c:390-393, 1431-1434) and MR_GetPhyParams checks rowSize/modFactor (:1359-1370), but the spanset twins (969, 599, 653-654) have no zero guards.

Fix validation

fix.diff (shared with DF-4330) rejects any map with a live quad->diff == 0 (or spanRowSize == 0 on RAID 0/5/6) inside MR_ValidateMapInfo, before mr_update_span_set runs:

kldload /root/fp4330_fixed/fp_probe.ko
sysctl hw.fp_probe_run=2      # -> "invalid RAID map geometry", returned 1,
                              #    NO panic, guest stays up (fix_run.log in DF-4330/)

DF-4331 — VERDICT

Status: reproduced (certain). Impact: kernel panic (trap 18, #DE).

Root cause

mr_update_span_set divides by the firmware-supplied quad diff (mrsas_fp.c:969) with no zero check, unlike every IO-time consumer of the same field (mrsas_fp.c:390-393 mr_spanset_get_span_block, :1431-1434 MR_GetSpanBlock — both explicitly set *div_error = 1 and bail). The function runs at RAID-map validation time, i.e. at adapter attach (mrsas.c:1762, gated only on fw supportUnevenSpans) and again on every AEN map update (mrsas.c:2961). Two more unguarded fw divisors exist on the UnevenSpan IO path: get_arm (:599, mega_mod64(stripe, SPAN_ROW_SIZE(...)) — spanRowSize fw u_int8_t) and mr_spanset_get_phy_params (:653-654, RAID-6 branch, same SPAN_ROW_SIZE divisor). The non-spanset twin MR_GetPhyParams does guard rowSize == 0 and modFactor == 0 (:1359-1370) — the guards were simply never added to the spanset copy.

Reproduction

Same probe as DF-4330 (unmodified guest mrsas_fp.c, symbol-renamed, MR_ValidateMapInfo entry). Map crafted with quad[0].diff = 0:

fp_probe: calling real MR_ValidateMapInfo() (spanDepth=1 quad[0].diff=0) ...
Fatal trap 18: integer divide fault while in kernel mode
kernel: type 18 trap, code=0
Stopped at probe_mr_update_span_set.part.0+0x1d7:  divq %rcx,%eax

(panic.txt, serial_decisive.log — serial console; guest wedged in ddb, vm.sh status ⇒ down right after.) The faulting instruction is the compiled mega_div64_32(((quad->logEnd - quad->logStart) + quad->diff), quad->diff) at source line 969. On real hardware a firmware image (or PCIe DMA attack) delivering diff = 0 for any live quad bricks the machine at boot or on the first config-change AEN — a persistent boot-time DoS.

Fix validation

fix.diff (shared with DF-4330) validates every live quad diff != 0 (and spanRowSize != 0 for RAID 0/5/6) inside MR_ValidateMapInfo before mr_update_span_set is called. Patched probe, mode 2: nexus0: invalid RAID map geometry (ld/span/quad), rejecting map, MR_ValidateMapInfo returned 1, no panic, guest stays up (../DF-4330/fix_run.log); benign mode-0 map still accepted (no regression).

Exploit chain

None — pure availability. (DoS bucket.)

Artifacts

panic.txt, run.log (panic run), serial_decisive.log, shared probe sources (fp_probe.c, rename.h, Makefile, build.sh), fix.diff, build.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.