{
  "finding_id": "DF-3817",
  "title": "hexdump() of firmware event data with unvalidated device-controlled length (console OOB read)",
  "verdict": "inconclusive",
  "impact": "none demonstrated at runtime; debug-gated heap info leak to console",
  "reproduce": {
    "build": "n/a",
    "run": "on SAS3 host: sysctl dev.mpr.0.debug_level=0x4 (MPR_EVENT), then have firmware deliver MPI2_EVENT_LOG_DATA with oversized EventDataLength",
    "expected": "console hexdump runs past the reply-frame buffer, printing adjacent kernel heap"
  },
  "kernel_refs": ["sys/dev/raid/mpr/mpr.c:2061-2067", "sys/dev/raid/mpr/mpr.c:1346", "sys/dev/raid/mpr/mpr.c:2356-2358"],
  "artifacts": ["README.md", "VERDICT.md", "probe.log", "fix.diff", "manifest.json", "verdict.json"]
}