{
  "finding_id": "DF-3896",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "mpssas_scsiio_complete computes csio->resid = cm->cm_length - rep->TransferCount (mps_sas.c:1943) on the DATA_UNDERRUN path with no ordering check; both operands are unsigned (cm_length is u_int, mpsvar.h:231) and TransferCount is an unvalidated IOC-supplied U32, so a reply claiming more bytes than requested wraps resid to ~UINT_MAX and corrupts CAM-periph/userland transfer-length accounting. Twin of DF-3675 (mpt_cam.c:3132). Not reproduced: no SAS2 HBA in the guest and the trigger additionally needs a misreporting IOC; underflow arithmetic is certain from source.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line proof incl. clamped sibling paths 2083/2114), env.txt, run.sh + run.log (hardware gate), fix.diff (clamp)",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_sas.c:1943",
    "sys/dev/raid/mps/mps_sas.c:2083",
    "sys/dev/raid/mps/mps_sas.c:2114",
    "sys/dev/raid/mps/mpsvar.h:231"
  ],
  "poc_changes": "n/a — hardware/firmware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "sh findings/poc/DF-3896/run.sh",
  "code_hash": "",
  "notes": "Twin of DF-3675 (mpt_cam.c), which was accepted Low with the same clamp fix; same expression exists in upstream FreeBSD mps(4).",
  "recommended_fix": "Clamp: resid = (TransferCount < cm_length) ? cm_length - TransferCount : 0.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the clamp; cannot be exercised on this guest (no SAS2 HBA).",
  "fix_evidence": "findings/poc/DF-3896/fix.diff"
}