{
  "finding_id": "DF-3819",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "aac_ioctl_send_raw_srb() sleeps on chan NULL (lksleep(cm,...) with cm==NULL at aac.c:3094) while its CMFREE callback wakes chan &cm (aac.c:2970); the correct sibling aac_ioctl_sendfib() uses lksleep(&cm,...) at aac.c:3003. Once the FIB pool is exhausted the ioctl thread sleeps uninterruptibly forever - unkillable D-state process reachable by group operator through /dev/aacd0. Hardware-gated: the audit guest has no AAC HBA (no /dev/aacd0, zero matching PCI vendors), so the path cannot be entered; defect is certain from source comparison.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (source excerpt + guest-absence proof); run.log (open ENOENT as root and as user); env.txt (uname, no aac PCI devices, driver compiled into kernel); fix.diff (one-token fix)",
  "kernel_refs": [
    "sys/dev/raid/aac/aac.c:3094",
    "sys/dev/raid/aac/aac.c:3003",
    "sys/dev/raid/aac/aac.c:2970",
    "sys/dev/raid/aac/aac.c:3082"
  ],
  "poc_changes": "Trigger written fresh (no seed): native FSACTL_SEND_RAW_SRB = _IO(8,19) computed from aac_ioctl.h, arg passed as pointer-to-pointer per aac.c:2832 arg = *(caddr_t*)arg.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o aac_rawsrb_hang aac_rawsrb_hang.c",
  "run_cmd": "./aac_rawsrb_hang /dev/aacd0",
  "code_hash": "e1e2005be508d77df2139daab2eecb898e500e24122e86515b8097af4452328e",
  "notes": "Impact on real hardware: permanent unkillable process (local DoS) by any operator-group user; requires all FIBs outstanding once. PoC binary built and executed on the guest; open() fails ENOENT proving hardware gating, not a code-path failure.",
  "recommended_fix": "Sleep on the address of the local variable: lksleep(&cm, ...) in aac_ioctl_send_raw_srb (aac.c:3094).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix cannot be exercised: baseline path requires an attached AAC controller, absent from the QEMU guest (no /dev/aacd0, no matching PCI vendor IDs). fix.diff is the one-token correction mirroring aac.c:3003.",
  "fix_evidence": "fix.diff"
}