{
  "finding_id": "DF-3923",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "On bus_setup_intr failure hpt_attach kfree()s pAdapter (entry.c:2026) which is the newbus-allocated softc (device_get_softc, entry.c:1992; driver_t size entry.c:100) - not driver memory. init_adapter already linked it into gIal_Adapter (entry.c:1280-1287) and unmasked interrupts (entry.c:1498), so post-failure any gIal_Adapter walk (ioctl.c:302, hptproc, worker entry.c:2438-2456) or newbus softc reuse dereferences freed memory. Requires an attach-time IRQ failure on real RR1820 hardware; not reproducible on the audit guest.",
  "exploit_chain": "IRQ setup failure at attach -> freed softc dangling on gIal_Adapter + newbus device -> later ioctl/rescan/probe UAF (crash-class, privileged contexts)",
  "evidence": "VERDICT.md ownership trace (entry.c:1992 vs 2026; 1280-1287 link)",
  "kernel_refs": ["sys/dev/raid/hptmv/entry.c:2026", "sys/dev/raid/hptmv/entry.c:1992", "sys/dev/raid/hptmv/entry.c:1280"],
  "poc_changes": "n/a (fresh pack)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "hardware error-path: IRQ setup failure at RR1820 attach",
  "code_hash": "",
  "notes": "Sibling: the earlier IRQ-alloc failure path (entry.c:2016-2020) returns with adapter linked, mem_res held and interrupts unmasked (leak, no UAF).",
  "recommended_fix": "Drop the kfree of the newbus softc and release the IRQ resource on failure",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff removes the erroneous kfree and releases resources; cannot validate without hardware",
  "fix_evidence": "fix.diff in this pack; never applied to sys/"
}