# DF-3800 evidence pack

Stale IOC-facts target-array reallocation in `mprsas_realloc_targets`
(`sys/dev/raid/mpr/mpr_sas.c:3911`) → heap OOB write after Diag Reset.

- Read `VERDICT.md` for the full source chain.
- `run.sh` — records the guest hardware gate (no SAS3 HBA; mpr unattached).
- `fix.diff` — realloc to current facts + update `sassc->maxtargets` + clamp.
- `verdict.json` — machine verdict (not_reproduced: hardware absent).