{
  "finding_id": "DF-3929",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on the guest: the trigger path requires mly/age hardware absent from the audit guest. fix.diff is mechanical (bounds/termination-only) and authored post-verification against the cited lines.",
  "fix_evidence": "findings/poc/DF-3929/fix.diff + VERDICT.md",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated (no mly controller in the guest); source-certain. Both completion walks in mly_done check only the upper bound: if (slot < MLY_SLOT_MAX) (mly.c:1535 HM, :1564 AM) then index sc->mly_command[slot - MLY_SLOT_START] with MLY_SLOT_START==1 (mlyvar.h:153) - a firmware completion carrying command_id 0 yields mly_command[-1], one struct (~104B) before the array, overlaying the tail of mly_btl[][]. The driver then writes mc_status/mc_sense/mc_resid (firmware values) and executes TAILQ_REMOVE via mly_remove_busy (mlyvar.h:345-352) on that fake entry - dereferencing and writing tqe_next/tqe_prev pointers read from firmware-fed btl fields (mb_state/mb_speed/mb_width from GETPHYSDEVINFOVALID, mly.c:928-930) - and finally mly_complete (mly.c:1612-1634) calls the garbage mc_complete function pointer threaded from the same region. Distinct from known DF-1290 (event channel/target) : this is the status-walk slot index, reachable with no user action as completions arrive unsolicited. Runtime reproduction requires the card; filed not_reproduced, certain at source level.",
  "exploit_chain": "malicious controller returns command_id 0 (or duplicate completions) in a status entry -> mly_command[-1] OOB writes + TAILQ pointer-write primitives + indirect call through firmware-fed memory -> corruption/RIP control",
  "evidence": "findings/poc/DF-3929/VERDICT.md; fix.diff (lower-bound check in both paths)",
  "kernel_refs": [
    "sys/dev/raid/mly/mly.c:1534",
    "sys/dev/raid/mly/mly.c:1535",
    "sys/dev/raid/mly/mly.c:1563",
    "sys/dev/raid/mly/mly.c:1564",
    "sys/dev/raid/mly/mlyvar.h:153",
    "sys/dev/raid/mly/mlyvar.h:206",
    "sys/dev/raid/mly/mlyvar.h:345",
    "sys/dev/raid/mly/mly.c:1612"
  ],
  "poc_changes": "No seed PoC; hardware-gated interrupt-path defect - lab reproduction documented (status_mailbox/command_id = 0).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 200,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3. Same-surface aggravators noted in VERDICT.md (duplicate-completion TAILQ corruption) not separately filed. mmbox status walk itself is bounded (flag cleared per iteration).",
  "recommended_fix": "Check slot >= MLY_SLOT_START in both mly_done completion paths.",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}