# DF-3925 VERDICT

**status: not_reproduced (hardware-gated, caller unauditable)** | **impact observed: none** | **source certainty: speculative**

## Analysis
- Sink: entry.c:864/872 write `sataEvents[channel]` (8-entry array, osbsd.h:170)
  and entry.c:875 `device_change(...VDevices[channel]...)` (8-entry array,
  osbsd.h:176), with `channel = (MV_U8)param2` taken from the callback args
  with no range validation (entry.c:860).
- Source: the only caller is inside the closed binary blob
  x86_64-elf.raid.o.uu (mvSata core). No in-tree call site can be checked;
  the historical open mvSata core bounded channelIdx by MV_SATA_CHANNELS_NUM.
- Therefore the OOB is *reachable only if* the blob ever emits param2 >= 8 or
  a truncation mismatch — unverifiable. Filed as a hardening finding
  (speculative), not a demonstrated bug. Runtime reproduction additionally
  requires the RR1820 card (absent, env.txt).

## Fix validation
Hardware-gated; one-line guard, no behavior change for valid channels.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.