# DF-3674 — NULL request dereference in mpt_scsi_reply_handler / mpt_scsi_tgt_reply_handler

Severity: Low (IOC-driven kernel NULL deref / panic). No userland trigger
exists — the NULL req comes from an IOC reply whose context index exceeds
the request pool (mpt.c:812-820 dispatches anyway). See VERDICT.md.

Build/run: none applicable (interrupt-path bug); guest has no MPT HBA
(env.txt). Upstream FreeBSD shares the missing guard.