{
  "finding_id": "DF-3695",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "ata_raid_delete kfrees the ar_softc with no drain of in-flight bios/requests; every in-flight ata_request keeps request->driver=rdp and ata_raid_done dereferences it after completion (type/status/disks/devstat), so an IOCATARAIDDELETE racing array I/O is a use-after-free on the M_AR chunk. Source-certain mechanism; no runtime attempt succeeded within this runs time box (needs a stallable member disk to widen the race window). Privileged trigger (root/operator).",
  "exploit_chain": "",
  "evidence": "README.md source trace (:1280-1314 teardown vs :4030 driver pointer vs :643/:847 completion derefs)",
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:1281",
    "sys/dev/disk/nata/ata-raid.c:1312",
    "sys/dev/disk/nata/ata-raid.c:4030",
    "sys/dev/disk/nata/ata-raid.c:643",
    "sys/dev/disk/nata/ata-raid.c:847"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "proper fix needs a lifetime rework (per-request softc references + drain before kfree); deliberately not band-aided in fix.diff",
  "recommended_fix": "reference-count ar_softc per in-flight request/strategy entry; delete marks !READY, drains, then frees",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "no fix authored (needs lifetime redesign, unvalidated band-aid would be worse)",
  "fix_evidence": "n/a"
}