{
  "finding_id": "DF-3924",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Unconditional panic(\"physical address unsupported\") at entry.c:2518/2522 in fOsBuildSgl, the build-sgl callback of every hptmv READ/WRITE (registered at entry.c:2799). passsendccb forwards CAM_DATA_PHYS CCBs to the SIM unfiltered (scsi_pass.c:565 skips mapping only when the flag is clear), so a root/operator pass CCB with CAM_DATA_PHYS + READ_10 reaches the panic immediately. Not reproduced: no RR1820 hardware on the audit guest.",
  "exploit_chain": "root -> /dev/passN CAMIOCOMMAND with CAM_DATA_PHYS + READ_10 -> hpt_action -> OsSendCommand -> fOsBuildSgl -> panic (DoS)",
  "evidence": "VERDICT.md trace; df3924.c exact CCB construction",
  "kernel_refs": ["sys/dev/raid/hptmv/entry.c:2518", "sys/dev/raid/hptmv/entry.c:2522", "sys/bus/cam/scsi/scsi_pass.c:565"],
  "poc_changes": "n/a (fresh pack)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -o df3924 df3924.c",
  "run_cmd": "sudo ./df3924 <hptmv-pass-unit> (hardware-bearing host only)",
  "code_hash": "8071c95f30d6c36229a1ab401ff1527589f43a66be5a05720ee96beb53c2a799",
  "notes": "Same defect family as DF-3921 (left-in debug panics reachable through CAM).",
  "recommended_fix": "Return FALSE instead of panic() in fOsBuildSgl for CAM_DATA_PHYS/CAM_SG_LIST_PHYS",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff swaps panics for FALSE returns routing into existing PIO/error handling; cannot validate without hardware",
  "fix_evidence": "fix.diff in this pack; never applied to sys/"
}