DF-4869 — mps debug/table layer: live-but-gated unvalidated NumEntries walk, dead config-page printers, sentinel+1 convention in mps_describe_table

What

Three related latent defects in sys/dev/raid/mps/mps_table.c (twin of DF-4790 on the mpr side):

1. Unvalidated firmware-count walk in mps_print_evt_sas (mps_table.c:332-345): for MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST it walks for (i = 0; i < data->NumEntries; i++) phy = &data->PHY[i]; where NumEntries is a firmware-supplied u8 (up to 255) and PHY[] entries are 4 bytes each (mpi2_ioc.h:825-844). The event buffer at this point is the reply frame itself (sc->reply_frames + offset, sys/dev/raid/mps/mps.c:1530-1543), sized ReplyFrameSize * 4 bytes per frame (mps.c:718) — so a 255-entry walk reads up to ~1 KB past a ~96-128-byte frame: a firmware-controlled OOB read inside the reply DMA arena. The function is live — mpssas_evt_handler calls it on every SAS event (sys/dev/raid/mps/mps_sas_lsi.c:131) — but every field read sits inside mps_dprint_field(MPS_EVENT, ...), gated on sc->mps_debug & MPS_EVENT (mpsvar.h:609, :628-632; default 0, root-set sysctl). Latent unless debugging is enabled.

2. Dead printers: mps_print_sasdev0 (mps_table.c:259-285), mps_print_expander1 (:383-421) and mps_print_sasphy0 (:423-447) have zero callers tree-wide (only declared in mps_table.h:47-50). They parse config-page buffers whose backing allocation size is never validated against the page struct; any future caller inherits the unvalidated-fw-count/unbounded-read pattern (the same pattern that produced the live findings DF-4559/DF-4560 on this driver's sibling code).

3. Sentinel+1 convention in mps_describe_table (mps_table.c:63-73): when no code matches it returns table[i+1].string — one entry past the {NULL, 0} sentinel. In-bounds today only because all nine tables in this file ship an extra "Unknown …" entry after the sentinel (:96-97, :106-107, :119-120, :127-128, :140-141, :150-151, :157-158, :166-167, :182-183); the two external users (mps_sas_lsi.c:671-673) also conform. Any new table that ends at the sentinel turns the fallback into a one-entry OOB read of static memory.

Minor: case MPI2_EVENT_SAS_DEVICE_STATUS_CHANGE at mps_table.c:363-377 is missing its break; — falls through into default: break;, benign today.

Trigger / threat

(1) fires only with hw.mps.N.debug (root-settable) at the MPS_EVENT bit and a malicious/buggy controller sending a topology event with NumEntries larger than the actual event data; (2) has no trigger path at all; (3) has no non-conforming table today. Pure hardening / latent-pattern filing (Info), so the patterns are not resurrected as-is — same rationale as DF-4790.

Reproduce

No trigger path exists on the audit guest (no MPT2 hardware — see env.txt; and for (2)/(3) no trigger path exists on any machine). Dead/latent code, verified by tree-wide grep for callers (see VERDICT.md).

Fix

fix.diff — bound the NumEntries walk by EventDataLength, return a literal fallback in mps_describe_table, and add the missing break;. Preferred alternative for (2): delete the three dead printers.

DF-4869 — VERDICT

Status: untested (no trigger path). Reproduced: 0. Impact: none (latent). Confidence: certain.

Why untested

• The audit guest has no LSI (vendor 0x1000) MPT2 controller; the mps driver never attaches (env.txt) — so the SAS event path itself cannot run.
• mps_print_sasdev0 / mps_print_expander1 / mps_print_sasphy0 have zero callers tree-wide; there is no trigger path on any machine.
• The mps_describe_table sentinel+1 fallback is in-bounds for every table that exists today; the OOB read only materializes for a future non-conforming table.

Liveness / bounds evidence (grep, tree-wide)

• Callers of mps_print_evt_sas: exactly one — mpssas_evt_handler (sys/dev/raid/mps/mps_sas_lsi.c:131), the registered mps event callback; runs on every async SAS event. All field reads inside the PHY walk are arguments to mps_dprint_field(sc, MPS_EVENT, ...), which compiles to if (sc->mps_debug & MPS_EVENT) kprintf(...) (sys/dev/raid/mps/mpsvar.h:609, :628-632) — args evaluated only when the debug bit is set (default 0; sc->mps_debug is settable only via the per-device sysctl, root-only).
• Callers of mps_print_sasdev0 / mps_print_expander1 / mps_print_sasphy0: none (declarations only, sys/dev/raid/mps/mps_table.h:47-50). Compare: mps_print_iocfacts (live, mps.c:1046), mps_print_portfacts (live, mps.c:1158), mps_print_event (live, mps.c:1264/:1648/:1724), mps_print_scsiio_cmd (live, mps_sas.c:2063 — see DF-4868).
• Event buffer at the walk: the reply frame inside sc->reply_frames (mps.c:1530-1543), per-frame size sc->facts->ReplyFrameSize * 4 (mps.c:718, firmware-reported); EventDataLength (dwords) is never used to bound the walk at mps_table.c:332.
• mps_describe_table fallback: return(table[i+1].string) at sys/dev/raid/mps/mps_table.c:72 — reads the entry after the {NULL,0} sentinel that terminated the loop at :68. All nine in-file tables carry a trailing "Unknown" entry; external callers (mps_sas_lsi.c:673) pass conforming tables.

Exploit chain

None — no reachable path in the shipped tree. Ceiling (if debugging is enabled by root AND a malicious controller supplies the event): console disclosure of reply-pool DMA memory past the event frame. Filed as Info hardening, mirroring DF-4790.

Fix validation

fix_status: not_testable — dead/latent code; the diff is a defensive bound plus cleanup, nothing to exercise on the guest.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.