{
  "finding_id": "DF-3927",
  "title": "siba_pcicore_intr computes 1 << tmp with MMIO-derived tmp up to 63 (SIBA_TPS_BPFLAG=0x3f) - UB shift silently enables wrong INTR_MASK bit on pre-rev6 PCI cores",
  "verdict": "not_reproduced (hardware-gated; upstream-inherited UB)",
  "impact_potential": "wrong interrupt routing on shared IRQ (correctness/availability); no memory-safety impact",
  "reproduce": {
    "build": "n/a",
    "run": "SSB card with PCI core sd_rev<6 reporting TPS BPFLAG>=32; call siba_pcicore_intr (bwn intr enable)",
    "expected": "wrong SIBA_INTR_MASK bit set (1<<(tmp&31)); NOT runnable on audit guest"
  },
  "kernel_refs": ["sys/dev/netif/bwn/siba/siba_core.c:2131", "sys/dev/netif/bwn/siba/sibareg.h:259"],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "env.txt", "manifest.json", "verdict.json"]
}