{
  "finding_id": "DF-3846",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Stale-handle lifetime defect: sc->map_update_cmd is assigned once in mrsas_sync_map_info (mrsas.c:3239) and never cleared anywhere in the driver. All three release paths for the map-sync mfi command return it to the shared 32-entry pool without nulling the pointer: the NOT_FOUND failure path (mrsas.c:2953, which issues no follow-up sync), the normal completion path (mrsas.c:2960), and the OCR re-fire loop (mrsas.c:2454-2455). mrsas_shutdown_ctlr (mrsas.c:3041-3042) later aborts whatever command now occupies that index/frame — after recycling this is an unrelated in-flight ioctl passthrough or internal DCMD of another thread, which receives a spurious abort completion. All indices stay in-bounds and pooled objects are permanent, so impact is wrong-command abort / status confusion at shutdown, not wild memory access (Low). Not executable on the audit guest: driver compiled in but no LSI HBA, no /dev/mrsas* (run.log); the structure of the defect (no clearing store exists) is source-certain.",
  "exploit_chain": "",
  "evidence": "VERDICT.md with the three uncleared release sites and the shutdown consumer; grep over mrsas*.c shows sc->map_update_cmd written only at mrsas.c:3239 and read only at mrsas.c:3041-3042.",
  "kernel_refs": ["sys/dev/raid/mrsas/mrsas.c:3239", "sys/dev/raid/mrsas/mrsas.c:2953", "sys/dev/raid/mrsas/mrsas.c:2960", "sys/dev/raid/mrsas/mrsas.c:2454", "sys/dev/raid/mrsas/mrsas.c:3041", "sys/dev/raid/mrsas/mrsas.c:3486"],
  "poc_changes": "No seed PoC; trigger requires an attached HBA completing a map sync and a later shutdown after pool recycling. Guest cannot reach the path.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 8,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level lifetime trace)",
  "run_cmd": "kldstat -v | grep -i mrsas; pciconf -lv | grep -i megaraid; ls /dev/mrsas*",
  "code_hash": "",
  "notes": "Low severity: stale pooled handle, in-bounds indices, abort-target confusion only. Same release-without-unregister pattern class as DF-3844 but with no double-release endpoint.",
  "recommended_fix": "Clear sc->map_update_cmd whenever the map-sync mfi command is released (mrsas.c:2953, 2960, 2454) so shutdown can never abort a recycled command.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff nulls the pointer at all three release sites; obviously removes the dangling consumer at mrsas.c:3041. Not boot-testable without the HBA -> not_testable.",
  "fix_evidence": "fix.diff four hunks at the exact release/consumer lines."
}