{
  "finding_id": "DF-3676",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardening gap (Info): mpt_abort_target_ccb indexes mpt->trt[ccb->ccb_h.target_lun] with no MPT_MAX_LUNS check (mpt_cam.c:4631-4635) while every sibling target-mode XPT case guards lun >= MPT_MAX_LUNS (mpt_cam.c:3683-3693, 4298, 4324). trt[] is 256 entries. Today no reachable producer hands mpt a path LUN >= 256 (pass paths are enumerated up to cpi->max_lun=256), so this is defense-in-depth at the SIM boundary, matching the sym DF-3574 precedent. Not executable on this guest (no MPT hardware).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (guard asymmetry with path:line); fix.diff; env.txt",
  "kernel_refs": [
    "sys/dev/disk/mpt/mpt_cam.c:4631-4635",
    "sys/dev/disk/mpt/mpt_cam.c:3683-3693",
    "sys/dev/disk/mpt/mpt.h:367",
    "sys/dev/disk/mpt/mpt.h:709"
  ],
  "poc_changes": "n/a",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info-severity hardening; SIM-boundary validation convention.",
  "recommended_fix": "Add else if (lun < MPT_MAX_LUNS) with CAM_LUN_INVALID return in mpt_abort_target_ccb",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Guard diff authored (fix.diff); not exercisable without hardware.",
  "fix_evidence": "fix.diff; env.txt"
}