# DF-3873 VERDICT — inconclusive (hardware-gated), source-certain

- Verified the direct user-pointer dereferences at the cited lines and the
  DragonFly fault policy: sys/platform/pc64/x86_64/trap.c:905-925 — a
  kernel-mode fault on a user-range address with no pcb_onfault (i.e. outside
  copyin/copyout) is fatal ("Fatal user address access from kernel mode").
- No SMAP on the standard guest/snapshot is irrelevant: the panic comes from
  the unmapped VA, not from protection.
- Trigger: ioctl(fd, MFI_CMD, (void*)0x515100001000UL) etc. — single syscall.
- Guest: device absent (run.log); code-level certainty high.
- fix.diff (illustrative for MFI_CMD; same pattern for the other cases):
  copyin the packet first, then operate on the kernel copy.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.