{
  "finding_id": "DF-3672",
  "verdict": "inconclusive",
  "impact": "none (demonstrated) / expected panic+read-oracle on real hardware",
  "reproduce": {
    "build": "cc -O -o mpt_tag_oob mpt_tag_oob.c",
    "run": "./mpt_tag_oob /dev/passN   (requires mpt FC target-mode HBA)",
    "expected": "kernel panic at MPT_TGT_STATE(mpt, cmd_req) or dump of attacker-addressed kernel words via mpt_tgt_dump_req_state"
  },
  "kernel_refs": [
    "sys/dev/disk/mpt/mpt.h:357-361",
    "sys/dev/disk/mpt/mpt.h:951-963",
    "sys/dev/disk/mpt/mpt_cam.c:4354-4356",
    "sys/dev/disk/mpt/mpt_cam.c:3711-3712",
    "sys/dev/disk/mpt/mpt_cam.c:4251-4256",
    "sys/dev/disk/mpt/mpt_cam.c:1343",
    "sys/dev/disk/mpt/mpt_cam.c:1652",
    "sys/bus/cam/scsi/scsi_pass.c:473-478"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "mpt_tag_oob.c", "build.sh", "run.sh",
    "env.txt", "run.log", "fix.diff", "verdict.json", "manifest.json"
  ]
}