# DF-3695 VERDICT

**Status: untested** (no runtime attempt succeeded within this run's scope).
impact: none demonstrated; source-indicated memory corruption (UAF).

## Analysis
`ata_raid_delete` (ata-raid.c:1280-1314) kfree's the `ar_softc` with no
drain of in-flight bios/requests. Every in-flight `ata_request` holds
`request->driver = rdp` (:4030) and `ata_raid_done` dereferences rdp
(:643/:662/:686/:800/:847) after hardware completion; `ata_raid_strategy`
also touches rdp unlocked while delete runs concurrently. A delete ioctl
issued while arX carries I/O therefore produces a use-after-free on the
M_AR chunk (read of type/status/disks, write of flags/last_lba, devstat
touch) — corruption or panic, timing-dependent.

## Why not verified
Requires a controlled race between IOCATARAIDDELETE and outstanding array
I/O. Setting that up on this guest needs a stallable member disk (the
legacy-IDE nata path has no latency-injection knob exposed here; QEMU IDE
has no throttling on this setup) and repeated hammering with
instrumentation to observe the free-then-complete ordering. Time-boxed out;
the mechanism is a straightforward code-read (no alternative interpretation
exists: there is no refcount, no lock held across the request lifetime, and
the completion callback is asynchronous by design).

## Classification
speculative-to-likely UAF; privileged trigger (root/operator via
/dev/ata*). Recommended fix requires a lifetime rework (per-request
references + drain before kfree) — see README; deliberately NOT included in
fix.diff to avoid shipping an unvalidated redesign.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)