DF-4560 VERDICT — reproduced (harness), Low, OOB fixed-offset reads on short fw events

Bottom line

mpssas_fw_work() dereferences fixed-offset members of the EventDataLength*4-sized heap copy with no size validation at two sinks that are NOT covered by the known findings: (a) the pre-loop element->VolDevHandle read at offset 0x0A (sys/dev/raid/mps/mps_sas_lsi.c:276-279) which executes even when NumElements == 0, so clamping the DF-1697 loop does not remove it; and (b) the LOG ENTRY ADDED LogEntryQualifier/LogData[0] reads at 0x0E/0x14 (sys/dev/raid/mps/mps_sas_lsi.c:515-518). With firmware-supplied EventDataLength of 1-2 (IR) or 1-5 (LOG) words these reads run past the kmalloc'd buffer.

Evidence

Guard-page harness (df4560_harness.c), guest DragonFly 6.5-DEVELOPMENT, run.log:

• IR, EDL=2 (8-byte alloc): read at +0x0A faults — 2 bytes OOB. Control EDL=3 (12 B): exact fit, clean.
• LOG, EDL=1: faults at the qualifier read (+0x0E); EDL=4 (16 B): qualifier in-bounds but LogData[0] (+0x14) still faults — the sinks are independently reachable; control EDL=6: clean.
• Arithmetic table in the same log enumerates every EDL 0..6.

Impact assessment (honest ceiling)

Bounded OOB reads (2 bytes / 1 byte) of heap memory adjacent to a fresh small kmalloc: the IR value feeds mps_mapping_get_raid_id_from_handle (a table walk; a garbage handle simply fails the lookup or yields an id within the IR range — whose use is DF-4559's problem, not made worse here), the LOG value only selects a kprintf branch. No bytes are returned to userspace — no disclosure; realistic worst case is a page-fault panic at a slab boundary (impact=panic class, low likelihood). Rated Low.

Root cause & fix

Root cause: mpssas_evt_handler records only the event type, not the validated length (sys/dev/raid/mps/mps_sas_lsi.c:83-87, 140-149), so handlers cannot check coverage. fix.diff adds u16 sz to mps_fw_event_work, sets it at enqueue, and gates both sinks (IR: sz >= sizeof(header)+sizeof(element) and NumElements > 0 before reading element[0]; LOG: sz >= offsetof(LogData)+1). Pure arithmetic model of the fix: the guarded minimums are exactly the EDL=3 / EDL=6 controls which run clean in run.log.

Notes

Distinct from DF-1696 (u16 truncation of sz itself / kmalloc(0)) and DF-1697 (loop counts vs. allocation): a driver patched for both would still take these two reads OOB on short-but-nonzero events.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.