{
  "finding_id": "DF-3818",
  "title": "NVMe PRP page pool exhaustion -> NULL deref / KASSERT panic under >2048 concurrent native-SGL NVMe I/Os",
  "verdict": "inconclusive",
  "impact": "none demonstrated at runtime; source-certain local DoS (panic) on NVMe-behind-SAS3 hosts",
  "reproduce": {
    "build": "n/a",
    "run": "on a SAS3 host with NVMe drives behind it: drive raw-device queue depth past 2048 concurrent native-SGL I/Os (e.g. 64 threads x 64 outstanding O_DIRECT reads of >=5 pages each)",
    "expected": "panic 'mpr_check_pcie_native_sgl: There are no PRP Pages left to be used for building a native NVMe SGL' (INVARIANTS kernels) or kernel page fault at NULL+offset (others)"
  },
  "kernel_refs": ["sys/dev/raid/mpr/mpr.c:2716-2720", "sys/dev/raid/mpr/mpr.c:2988-2991", "sys/dev/raid/mpr/mpr.c:3483-3487", "sys/dev/raid/mpr/mpr.c:375-381", "sys/dev/raid/mpr/mpr.c:1593-1631", "sys/dev/raid/mpr/mprvar.h:40,59", "sys/dev/raid/mpr/mprvar.h:545-558"],
  "artifacts": ["README.md", "VERDICT.md", "probe.log", "fix.diff", "manifest.json", "verdict.json"]
}