{
  "finding_id": "DF-3816",
  "title": "mpr_dump_reqs sysctl: unlocked walk of live command/chain lists + fixed 128-byte reads past device-sized frames",
  "verdict": "inconclusive",
  "impact": "none demonstrated at runtime; privileged race/UAF-read + bounded OOB read",
  "reproduce": {
    "build": "n/a",
    "run": "on SAS3 host: while I/O runs, repeatedly: sysctl -N to find the dump_reqs oid, then sysctl -b <oid> as root",
    "expected": "nondeterministic garbage/leak in the returned buffer; panic possible when a command completes (or a reallocating reinit frees sc->chains, mpr.c:787-788) mid-walk"
  },
  "kernel_refs": ["sys/dev/raid/mpr/mpr.c:1846-1848", "sys/dev/raid/mpr/mpr.c:1904-1922", "sys/dev/raid/mpr/mpr.c:1530", "sys/dev/raid/mpr/mpr.c:397-405"],
  "artifacts": ["README.md", "VERDICT.md", "probe.log", "fix.diff", "manifest.json", "verdict.json"]
}