# DF-3693 VERDICT

**Status: inconclusive** (runtime) / **certain** (source). impact: leak
(not demonstrated at runtime on this hardware).

## Why inconclusive at runtime
The HPTv2/HPTv3 parsers are vendor-gated on `ATA_HIGHPOINT_ID`
(ata-raid.c:1416-1420). The audit guest exposes only an Intel PIIX3 IDE
controller (QEMU default), so `AR_F_HPTV2_RAID`/`AR_F_HPTV3_RAID` can never
be instantiated and `ata_raid_hptv2_write_meta` cannot be reached. No other
reachable route exists (write_metadata dispatches purely on rdp->format).

## Why the source claim is certain
- `kmalloc(sizeof(struct hptv2_raid_conf))` = 512 bytes (verified by
  compiling the packed struct from the real header with the guest's cc —
  see analysis.txt).
- The write passes `sizeof(struct promise_raid_conf)` = 2048 bytes to
  `ata_raid_rw`, which sets `request->data = data; request->bytecount =
  bcount` and DMAs that many bytes from the buffer to disk
  (ata-raid.c:4087-4131, 1972-1975).
- 1536 bytes beyond the allocation are therefore persisted into LBA 9..12
  of every member disk, on every forced writeback (status change at boot,
  subdisk detach :4179, spare add, generation bumps).
- The overflow is compile-time-constant; there is no path-sensitive
  condition to dispute.

## Impact ceiling
Kernel-heap-content disclosure to persistent storage. The metadata sectors
are world-position-stable (HPTV2_LBA = 9) and re-readable by whoever
controls the disk later (operator/physical/cloud-image). Adjacent M_AR /
kmem allocations can contain pointers and file data. No write primitive, no
direct kernel-execution path → Medium.

## Fix
One-line: use `sizeof(struct hptv2_raid_conf)` as the write length
(included in fix.diff; not behaviorally validated on this guest for the
hardware reason above — fix_status = not_testable with this stated reason).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.