# DF-3949 — Verification Verdict

**Status:** inconclusive (hardware-gated; source-certain)
**Impact demonstrated:** none (expected: kernel panic)
**Confidence:** certain (source), runtime untestable (no Mylex DAC960 HBA in QEMU guest)

## Source proof

1. Copy-paste index bug: `sys/dev/raid/mlx/mlx.c:753`
   `*arg = device_get_unit(sc->mlx_sysdrive[0].ms_disk);` inside the loop
   that just verified `sc->mlx_sysdrive[i].ms_disk != NULL` (mlx.c:750).
   Should be `[i]`.
2. State producer: MLX_DETACH_DRIVE (mlx.c:774-804) deletes the child of the
   requested drive and sets `dr->ms_disk = NULL` (mlx.c:796); drive 0 can be
   detached while later drives remain attached.
3. `device_get_unit` is a direct deref: `sys/kern/subr_bus.c:1646-1649`
   `int device_get_unit(device_t dev) { return(dev->unit); }` → NULL+offset
   read → kernel page fault.
4. Privilege: `/dev/mlxN` created `UID_ROOT, GID_OPERATOR, S_IRUSR|S_IWUSR`
   (mlx.c:466-468) — operator/root only ⇒ Low severity.

## Guest result

Trigger compile-tested on DragonFly 6.5-DEVELOPMENT guest (BUILD_RC=0);
runtime exits ENOENT — no DAC960 controller present. Honest classification:
inconclusive, not false-positive (the path is fully live source; every hop
cited).

## Fix validation

fix.diff: one-token change `[0]` → `[i]`. Not runtime-testable on this guest
(no HBA) → fix_status: not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.