{
  "finding_id": "DF-3694",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "ata_raid_jmicron_write_meta (:2736, fires whenever a member has no serial - true for every ioctl-created array) and ata_raid_via_write_meta (:3986, unconditional) store (u_int32_t)(uintptr_t)rdp->disks[disk].dev - low 32 bits of live kernel device_t pointers - into checksummed on-disk metadata that is persisted on every config writeback. Straight-line dataflow, no conditionals; source-certain. Runtime test impossible here: both formats are PCI-vendor-gated (JMicron/VIA) and the guest has Intel IDE only.",
  "exploit_chain": "",
  "evidence": "analysis.txt (full source trace incl. round-trip: leaked value is checksummed and re-parsed)",
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:2736",
    "sys/dev/disk/nata/ata-raid.c:3986",
    "sys/dev/disk/nata/ata-raid.c:2753",
    "sys/dev/disk/nata/ata-raid.c:4005"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a (JMicron/VIA controller required)",
  "code_hash": "",
  "notes": "partial KASLR/heap-randomization erosion; value durable across reboots in the disk image; readable by anyone with raw member-disk access.",
  "recommended_fix": "store karc4random() instead of a truncated kernel pointer (fix.diff hunks 8+9)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "constant substitution included in fix.diff; not runtime-validatable on this guest",
  "fix_evidence": "fix.diff hunks @@ -2733,7 +2760,7 @@ and @@ -3983,7 +4010,7 @@"
}