# DF-3923 VERDICT

**status: not_reproduced (hardware-gated error path)** | **impact observed: none (potential: UAF of kernel memory)** | **source certainty: likely**

## Trace
- entry.c:1992 `IAL_ADAPTER_T *pAdapter = device_get_softc(dev);` — newbus
  softc (driver_t size entry.c:100); only kmalloc'd if softc were NULL
  (entry.c:2000-2004), which never happens for an attached PCI device.
- entry.c:2011 init_adapter succeeds → adapter linked into gIal_Adapter
  (entry.c:1280-1287), MV core initialized, interrupts unmasked
  (entry.c:1498).
- entry.c:2026 `kfree(pAdapter, M_DEVBUF)` on bus_setup_intr failure frees
  memory newbus still owns; gIal_Adapter list retains the dangling pointer
  (no unlink anywhere on this path).
- Consumers of gIal_Adapter: ioctl.c:302 (RESCAN_DEVICES walk),
  hptproc.c/Kernel_DeviceIoControl, entry.c:2438-2456 (worker SIGSTOP walk),
  launch_worker_thread (entry.c:2486). Newbus also reuses the softc on the
  next probe of the same devclass unit.

## Why not reproduced
Needs a present RR1820 whose IRQ setup fails at attach — no such hardware on
the audit guest (env.txt). Confidence "likely": the double-ownership/free is
unambiguous, but reaching it requires a specific attach failure on real
hardware.

## Fix validation
Not possible without the controller. fix.diff removes the erroneous kfree and
adds teardown.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.