{
  "finding_id": "DF-3820",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Five adapter-controlled indices are turned into kernel pointers with no bounds validation: aac.c:853 (index>>2 into aac_commands from MMIO outbound queue), aac.c:1118 (SenderData from DMAd FIB into aac_commands, dead NULL check), aac.c:2221-2223 (aq_fib_addr/512 into the 8-slot ac_fibs[]), aac.c:2238-2240 (aq_fib_addr>>2 into aac_commands), aac.c:3771-3772 (BusCount over the 10-entry stack BusValid/InitiatorBusId arrays). A malicious or faulty AAC controller gets controlled wild-pointer derefs and unlink-style writes through the fake aac_command (aac_remove_busy TAILQ_REMOVE, callout_stop, cm_complete indirect call). Cannot be exercised: guest has no AAC HBA (no /dev/aacd0, zero matching PCI vendor IDs, driver compiled into kernel but never attaches).",
  "exploit_chain": "device-side: craft completion index -> fake struct aac_command at chosen kernel offset -> aac_remove_busy()/aac_unmap_command()/cm->cm_complete(cm) write through it -> kernel code execution. Precondition: compromised/faulty PCIe controller firmware.",
  "evidence": "VERDICT.md table of the five sites with exact bounds that are missing; ../DF-3819/env.txt for guest hardware absence; fix.diff adding all five checks",
  "kernel_refs": [
    "sys/dev/raid/aac/aac.c:853",
    "sys/dev/raid/aac/aac.c:1118",
    "sys/dev/raid/aac/aac.c:2221",
    "sys/dev/raid/aac/aac.c:2238",
    "sys/dev/raid/aac/aac.c:3771",
    "sys/dev/raid/aac/aacvar.h:71"
  ],
  "poc_changes": "No trigger exists for device-DMA-only paths; pack is analysis + fix only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Device-trust hardening family; same pattern exists in the FreeBSD ancestor. Severity Low because exploitation requires controller-firmware compromise, but the primitives are arbitrary kernel writes once that holds.",
  "recommended_fix": "Bounds-check every adapter-supplied index before pointer formation (see fix.diff: total_fibs, AAC_ADAPTER_FIBS, AAC_SCSI_MAX_PORTS).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline and patched runs both require an attached AAC controller; absent on the audit guest, so the fix cannot be exercised. Diff compiles-by-inspection against the current tree.",
  "fix_evidence": "fix.diff"
}