{
  "finding_id": "DF-3774",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ahci_set_feature() (ahci.c:4057/4059) and ahci_read_log() (ahci.c:4090/4092) dereference the return of ahci_ata_get_xfer() without a NULL check; the function returns NULL when the per-port CCB free list is empty (sc_ncmds-1 slots, all holdable by concurrent CAM submissions whose devq has exactly that many openings, ahci_cam.c:111-115). NULL xa faults on xa->fis (first struct member) - kernel panic. ahci_read_log is reached from DevSleep probe (ahci_cam.c:605) and ahci_set_feature from the root-gated link_pwr_mgmt sysctl and DIPM negotiation. Same defect class as DF-2420/DF-2423; these are the ahci.c sites neither record covers. Not reproduced: guest has no AHCI controller.",
  "exploit_chain": "",
  "evidence": "VERDICT.md; ahci.c:4057+4059 and ahci.c:4090+4092 (unchecked deref); ahci.c:3674-3679 (get_xfer NULL path); ahci.h/atascsi.h:356-358 (fis is first member); ahci_cam.c:111-115 (devq openings == pool depth)",
  "kernel_refs": ["sys/dev/disk/ahci/ahci.c:4057", "sys/dev/disk/ahci/ahci.c:4090", "sys/dev/disk/ahci/ahci.c:3674", "sys/dev/disk/ahci/ahci_cam.c:605"],
  "poc_changes": "No runtime PoC - no AHCI hardware on guest; class mechanics documented in DF-2420/DF-2423.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "notes": "Cross-references DF-2420 (ahci_cam.c) and DF-2423 (ahci_pm.c) - same class, distinct file/sites.",
  "recommended_fix": "NULL-check the ahci_ata_get_xfer() return in ahci_set_feature and ahci_read_log and return EBUSY.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Two-line guard authored; cannot be exercised without AHCI hardware.",
  "fix_evidence": "fix.diff in this pack."
}