# DF-3871 VERDICT — inconclusive (hardware-gated), source-certain

- Code path verified line-by-line: mfi.c:2953-2962 (lookup), subr_bus.c:950-958
  (NULL for out-of-range unit), mfi.c:2958 (lockmgr through NULL sc).
- The sibling Linux shim paths DO NULL-check (mfi.c:3146-3147, 3167-3168),
  which is direct evidence the check was simply forgotten in the native path.
- PoC builds and runs on the guest; `/dev/mfi0` absent (no MegaRAID controller)
  so the kernel path cannot fire here — run.log records the ENOENT.
- Trigger is one ioctl with `mfi_adapter_no=1` on any real mfi host; write to
  near-NULL in kernel mode -> trap_fatal -> panic. Impact: local DoS by any
  user with the device open (operator group).
- fix.diff adds the same NULL check the Linux shim already has.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.