{
  "finding_id": "DF-3921",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain at source level: hpt_attach registers hpt_async for AC_LOST_DEVICE (entry.c:2071-2074) and hpt_asyncs entire body is panic(\"Here\") (entry.c:2147). AC_LOST_DEVICE is broadcast by CAM whenever a probed target disappears at rescan (cam_xpt.c:6223, cam_xpt.c:6384, cam_periph.c:1764) - i.e. the expected failure mode of a RAID member disk. Not reproduced: audit guest has no hptmv hardware.",
  "exploit_chain": "disk loss/hot-unplug (or root camcontrol rescan) -> CAM rescan probe failure -> xpt_async(AC_LOST_DEVICE) -> hpt_async -> panic; availability impact on any RR1820 host",
  "evidence": "VERDICT.md trace; entry.c:2147 unconditional panic; registration at entry.c:2071-2074",
  "kernel_refs": [
    "sys/dev/raid/hptmv/entry.c:2147",
    "sys/dev/raid/hptmv/entry.c:2071",
    "sys/bus/cam/cam_xpt.c:6223"
  ],
  "poc_changes": "n/a (fresh pack)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "hardware: remove RR1820 disk + camcontrol rescan <bus>",
  "code_hash": "",
  "notes": "Left-in debug panic (upstream FreeBSD heritage: r1.26 entry.c). Realistic trigger is the RAID controllers normal failure event, hence Medium.",
  "recommended_fix": "Remove panic(\"Here\") from hpt_async - make it the intended no-op",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff turns hpt_async into a no-op; cannot validate without RR1820 hardware",
  "fix_evidence": "fix.diff in this pack; never applied to sys/"
}