{
  "finding_id": "DF-3875",
  "title": "mfi_intr reply-context bound (mfi_max_fw_cmds) exceeds allocated mfi_commands[] (mfi_total_cmds) -> OOB under FW misbehavior",
  "verdict": "inconclusive (hardware-gated), speculative",
  "impact": "heap corruption (controller-gated)",
  "reproduce": { "build": "n/a (needs hostile/faulty firmware)", "run": "n/a", "expected": "OOB mfi_commands index from reply queue" },
  "kernel_refs": ["sys/dev/raid/mfi/mfi.c:1229","sys/dev/raid/mfi/mfi.c:758","sys/dev/raid/mfi/mfi.c:763","sys/dev/raid/mfi/mfi.c:785"],
  "artifacts": ["README.md","VERDICT.md","fix.diff","manifest.json","verdict.json","env.txt"]
}