{
  "finding_id": "DF-3693",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "ata_raid_hptv2_write_meta kmallocs 512 bytes (sizeof hptv2_raid_conf, verified by compiling the packed struct from the real header on the guest) but writes sizeof(promise_raid_conf)=2048 bytes to each member disk, persisting 1536 bytes of adjacent kernel heap into fixed metadata sectors (LBA 9..12) on every writeback (boot status change, subdisk detach, spare ops). Runtime test impossible on this guest: HPTv2/HPTv3 formats are PCI-vendor-gated to HighPoint controllers and the guest has only Intel PIIX3 IDE. Buffer-size mismatch is compile-time constant - source analysis certain.",
  "exploit_chain": "",
  "evidence": "analysis.txt (guest-compiled sizeof transcript: hptv2=512, promise=2048; vendor gating trace; writeback trigger trace)",
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:1903",
    "sys/dev/disk/nata/ata-raid.c:1974",
    "sys/dev/disk/nata/ata-raid.c:1492",
    "sys/dev/disk/nata/ata-raid.c:4179"
  ],
  "poc_changes": "no PoC possible on this hardware; layout verification tooling only",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp/poc && cc -O -o layout2 layout2.c && ./layout2  (struct size proof)",
  "run_cmd": "n/a (HighPoint controller required to instantiate AR_F_HPTV2_RAID)",
  "code_hash": "",
  "notes": "write_metadata routes both HPTv2 and HPTv3 formats to this function, so both HighPoint generations leak.",
  "recommended_fix": "write sizeof(struct hptv2_raid_conf) instead of sizeof(struct promise_raid_conf) (fix.diff hunk 7)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "one-line constant change included in fix.diff; cannot be behaviorally validated on this guest (no HighPoint controller)",
  "fix_evidence": "fix.diff hunk @@ -1971,7 +1998,7 @@"
}