{
  "finding_id": "DF-3677",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain logic bug: the raid_passthru gate in mpt_action (mpt_cam.c:3292-3302) excludes XPT_RESET_DEV from mpt_map_physdisk(), so the raw phydisk-bus target id is passed to mpt_bus_reset (3350) which issues the TMF on channel 0 (2279-2287) — resetting the RAID volume that shares the numeric id instead of the intended physical disk. I/O commands map correctly (mpt_start 2104-2112), proving the omission. Impact on hardware: wrong-device TARGET_RESET, disrupting in-flight volume I/O (availability/data-integrity); requires an MPT RAID controller, absent on this guest.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (three-site comparison with path:line); fix.diff (map in the RESET_DEV case); env.txt",
  "kernel_refs": ["sys/dev/disk/mpt/mpt_cam.c:3292-3302", "sys/dev/disk/mpt/mpt_cam.c:3342-3359", "sys/dev/disk/mpt/mpt_cam.c:2279-2287", "sys/dev/disk/mpt/mpt_cam.c:2104-2112", "sys/dev/disk/mpt/mpt_raid.c:806-819"],
  "poc_changes": "n/a",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "camcontrol reset <phydisk pass node> on MPT RAID hardware (absent)",
  "code_hash": "",
  "notes": "Shared with upstream FreeBSD vintage (r1.84-era code).",
  "recommended_fix": "Call mpt_map_physdisk() for XPT_RESET_DEV on the phydisk sim before issuing the TMF",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Mapping fix authored (fix.diff); not exercisable without MPT RAID hardware.",
  "fix_evidence": "fix.diff; env.txt"
}