git: 304d7fcdf48a - stable/14 - kernel dump: dumpsys_gen_pa_next(): Fix "no more chunks" condition detection

The branch stable/14 has been updated by olce:

URL: https://cgit.FreeBSD.org/src/commit/?id=304d7fcdf48a8bb89e6c0195db9bb7b0a2a6ea18

commit 304d7fcdf48a8bb89e6c0195db9bb7b0a2a6ea18
Author:     Olivier Certner <olce@FreeBSD.org>
AuthorDate: 2026-02-04 13:04:20 +0000
Commit:     Olivier Certner <olce@FreeBSD.org>
CommitDate: 2026-07-23 09:59:02 +0000

    kernel dump: dumpsys_gen_pa_next(): Fix "no more chunks" condition detection
    
    In the (improbable) cases where either:
    - All entries in dump_map[] are used, so there is no guard entry filled with zeros.
    - Some dump region has size 0.
    We would respectively access dump_map[] out-of-bounds or omit further
    dump regions when iterating.
    
    MFC after:      2 weeks
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit 7e5f4bb3a1c999d1893528faa75559f37365de47)
---
 sys/kern/kern_dump.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sys/kern/kern_dump.c b/sys/kern/kern_dump.c
index a3ca716b2861..51bdb86e229b 100644
--- a/sys/kern/kern_dump.c
+++ b/sys/kern/kern_dump.c
@@ -83,7 +83,8 @@ dumpsys_gen_pa_next(struct dump_pa *mdp)
 		return (&dump_map[0]);
 
 	mdp++;
-	if (mdp->pa_size == 0)
+	if (mdp - dump_map >= nitems(dump_map) ||
+	    (mdp->pa_start == 0 && mdp->pa_size == 0))
 		mdp = NULL;
 	return (mdp);
 }