{
 "finding_id": "DF-3875",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "none",
 "confidence": "speculative",
 "verdict": "Reply-queue contexts are bounds-checked against mfi_max_fw_cmds while mfi_commands[] holds only MIN(128,max_fw_cmds) entries; a firmware-posted context in between indexes OOB (list surgery + indirect call). Requires misbehaving controller; not user-reachable; fix is a one-token bound change.",
 "exploit_chain": "",
 "evidence": "VERDICT.md; mfi.c:1229 vs :758-785",
 "kernel_refs": [
  "sys/dev/raid/mfi/mfi.c:1229",
  "sys/dev/raid/mfi/mfi.c:758",
  "sys/dev/raid/mfi/mfi.c:763"
 ],
 "poc_changes": "no runnable PoC",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT x86_64 (no MegaRAID)",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "",
 "code_hash": "",
 "notes": "impact field none because controller-gated robustness hole, not user-reachable",
 "recommended_fix": "bound context by sc->mfi_total_cmds",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "trivial bound fix; not validatable without HW",
 "fix_evidence": "fix.diff"
}