# DF-3924 VERDICT

**status: not_reproduced (hardware-gated)** | **impact observed: none (potential: privileged DoS panic)** | **source certainty: certain**

## Trace
- scsi_pass.c:565-568: passsendccb calls cam_periph_mapmem ONLY when
  CAM_DATA_PHYS is clear; a CAM_DATA_PHYS CCB is forwarded to the SIM as-is.
- entry.c:2799: every hptmv READ/WRITE gets pfnBuildSgl = fOsBuildSgl.
- entry.c:2517-2518 / 2521-2522: unconditional panic() when the flag is seen
  with a logical (mapped) buffer request.
- Trigger actor: root / SYSCAP_RESTRICTEDROOT through /dev/passN (see
  DF-3920 privilege analysis) on an hptmv target.

Not reproduced: audit guest has no RR1820 (env.txt); panic is unconditional
at source, so the only uncertainty is reachability of the hardware, not the
crash.

## Fix validation
Hardware-gated; fix.diff replaces the panics with FALSE returns, which route
the command to the existing PIO path / RETURN_NEED_LOGICAL_SG error handling
(fDeviceSendCommand entry.c:1792-1805).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.