{
  "finding_id": "DF-2487",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "HW-gated at runtime: the mpt character device is created only when an LSI MPT HBA attaches (mpt_user.c:116 inside the attach path); the guest has no MPT controller (pciconf -l shows PIIX3 IDE + virtio only, camcontrol shows the QEMU DVD only), so /dev/mptN does not exist and the ioctl path is dead here. The defect is source-certain: mpt_ioctl dispatches MPTIO_WRITE_CFG_PAGE (mpt_user.c:715) and MPTIO_RAID_ACTION (:729) - both state-mutating, including volume deletion - with no check that the fd was opened FWRITE, while the node is created 0640 GID_OPERATOR (operator can open O_RDONLY). The fix adds a_fflag & FWRITE gates to both cases; validated by building the complete mpt.ko module (all six objects, -Werror) against the patched tree - the first compile round correctly caught the wrong field name (a_oflags -> a_fflag) and a missing fcntl.h include, proving the validation path exercises the real driver.",
  "exploit_chain": "privileged-boundary bypass for the operator group on machines with MPT hardware; not reachable on this guest.",
  "evidence": "mpt.ko built clean with the fix (compile validation); source trace of both dispatch sites.",
  "kernel_refs": [
    "sys/dev/disk/mpt/mpt_user.c:116",
    "sys/dev/disk/mpt/mpt_user.c:715",
    "sys/dev/disk/mpt/mpt_user.c:729",
    "sys/dev/disk/mpt/mpt_user.c:590"
  ],
  "poc_changes": "no rig - compile validation against the real module build.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/dev/disk/mpt && make -m /usr/src/share/mk all",
  "run_cmd": "(compile validation only - no MPT hardware on the guest)",
  "code_hash": "f3d61859032b8179aa5d09bcfc92617006ae2add0b89ae52c96ef4cb67a2496e",
  "notes": "HW-gated: mpt cdev is created only when an LSI MPT HBA attaches (mpt_pci attach -> mpt_user.c:116); no such controller on the guest (pciconf verified). Source-certain: no FWRITE check anywhere in mpt_ioctl; device mode 0640 GID_OPERATOR at mpt_user.c:116 while MPTIO_WRITE_CFG_PAGE (:715) and MPTIO_RAID_ACTION (:729) mutate state. Fix compile-validated by building the full mpt.ko module (-Werror) against the patched tree.",
  "recommended_fix": "require FWRITE on the fd for MPTIO_WRITE_CFG_PAGE and MPTIO_RAID_ACTION",
  "fix_status": "compile_validated"
}