{
  "finding_id": "DF-3927",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "siba_pcicore_intr masks the MMIO TPS register to 6 bits (SIBA_TPS_BPFLAG=0x3f) and shifts 1 by that value (siba_core.c:2131-2132); tmp in [32,63] is UB and on x86 silently enables bit (tmp&31) of SIBA_INTR_MASK - the wrong interrupt source on the shared PCI IRQ, for pre-rev6 PCI cores only. Correctness/availability defect inherited from upstream FreeBSD siba; no memory-safety impact; not reproducible on the audit guest (no SSB hardware).",
  "exploit_chain": "",
  "evidence": "VERDICT.md; sibareg.h:259 (0x3f mask) vs siba_core.c:2131 shift",
  "kernel_refs": ["sys/dev/netif/bwn/siba/siba_core.c:2131", "sys/dev/netif/bwn/siba/sibareg.h:259"],
  "poc_changes": "n/a (fresh pack)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Info-level: UB shift with hardware-controlled count; upstream-inherited (identical expression in FreeBSD siba).",
  "recommended_fix": "Guard the shift: only OR (1u << tmp) when tmp < 32",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the tmp<32 guard; cannot validate without SSB hardware",
  "fix_evidence": "fix.diff in this pack; never applied to sys/"
}