DF-4561 — mpssas_ir_shutdown skips the last IR volume slot (off-by-one)

File: sys/dev/raid/mps/mps_sas_lsi.c:902-911 Severity: Low (data integrity at shutdown; no memory unsafety) Status: untested at driver level (needs an LSI IR HBA to exercise the shipped path); the loop-coverage arithmetic is deterministic and was executed on the guest (tail of findings/poc/DF-4560/run.log).

What the bug is

end_idx = start_idx + sc->max_volumes - 1 is the LAST slot of the IR map range — the exact formula of _mapping_get_ir_maprange() (mps_mapping.c:234), whose consumers scan it inclusively (map_idx <= end_idx, mps_mapping.c:366). The shutdown scan however uses

for (id = start_idx; id < end_idx; id++)

and therefore visits only max_volumes - 1 slots. A volume mapped into the final slot of the IR range is never seen, found_volume stays 0, and MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED is never sent to the IOC: the volume's onboard write cache is not flushed at poweroff → dirty shutdown / potential data loss on the last writes.

Proof (arithmetic, executed on the guest, see DF-4560/run.log tail)

IR range [256..263] (8 slots); loop visits 7, last visited 262
-> slot 263 (the LAST volume slot) NEVER checked

Fix

One character: id < end_idx → id <= end_idx (see fix.diff).

DF-4561 VERDICT — untested (no HBA), Low, deterministic off-by-one proven by source + arithmetic

Bottom line

mpssas_ir_shutdown() scans id ∈ [start_idx, end_idx) while the IR map range it is scanning is [start_idx, end_idx] inclusive (sys/dev/raid/mps/mps_sas_lsi.c:902 end_idx = start_idx + sc->max_volumes - 1, loop at :904 id < end_idx; compare the inclusive consumers of the identical formula in sys/dev/raid/mps/mps_mapping.c:234 and :366). The final IR slot is never examined, so a volume mapped there never receives the SYSTEM_SHUTDOWN_INITIATED RAID action → unflushed volume write cache at poweroff.

Why untested

The shipped path requires an mps controller with IR firmware (the QEMU guest has none). The defect is a pure loop-bound arithmetic error with no environmental dependence; the coverage count (visits 7 of 8 slots, last visited = end_idx-1, slot end_idx never checked) was computed and printed on the guest (tail of findings/poc/DF-4560/run.log). No runtime behavior beyond that arithmetic exists to observe without hardware, so the honest status is untested rather than reproduced.

Impact

Data integrity only (dirty shutdown of the last IR volume slot); no memory unsafety, no information flow. Low.

Fix

id <= end_idx (fix.diff — one-token change, matches the inclusive semantics used everywhere else the formula appears).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.