{
  "finding_id": "DF-3925",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "entry.c:860 truncates the MV core callbacks MV_U32 param2 to MV_U8 and uses it unvalidated to index sataEvents[8] (:864/:872) and VDevices[8] (:875). The only caller is the precompiled mvSata core blob (x86_64-elf.raid.o.uu) whose param2 discipline cannot be audited from source; the historical core bounded it to [0,7]. Filed as speculative hardening: add a range guard in the open glue. No runtime test possible (no RR1820 on guest).",
  "exploit_chain": "",
  "evidence": "VERDICT.md provenance analysis; Makefile links hptmvraid.bo from x86_64-elf.raid.o.uu (closed)",
  "kernel_refs": [
    "sys/dev/raid/hptmv/entry.c:860",
    "sys/dev/raid/hptmv/entry.c:864",
    "sys/dev/raid/hptmv/entry.c:875"
  ],
  "poc_changes": "n/a (fresh pack)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Interrupt/completion index math inside the MV core itself is closed-source; this guard is the only open-source-owned validation point.",
  "recommended_fix": "Validate channel < MV_SATA_CHANNELS_NUM at the top of the MV_EVENT_TYPE_SATA_CABLE case",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "one-line guard authored in fix.diff; cannot validate without hardware",
  "fix_evidence": "fix.diff in this pack; never applied to sys/"
}