{
  "finding_id": "DF-3983",
  "title": "sbp(4): sbp_orb_pointer fw_asyreq-failure path xpt_done()s the CCB while leaving the OCB queued, timeout-armed and dmamap-loaded -> double completion / free_ocbs duplication",
  "verdict": "inconclusive_source_certain_hardware_gated",
  "impact_ceiling": "double xpt_done of a completed CCB (CAM UAF/panic) + duplicate free_ocbs node -> shared OCB across two CCBs (kernel heap corruption)",
  "reproduce": {
    "build": "n/a (source-level; needs FireWire hardware)",
    "run": "n/a: attach SBP device, sustain tlabel/AT-queue saturation from a hostile 1394 peer (fw_asyreq EINVAL/EIO, firewire.c:230-242) while I/O runs",
    "expected": "second completion of the same CCB via sbp_timeout->sbp_abort_all_ocbs (sbp.c:2705-2707) or via the device status (sbp.c:1774) after the error-path completion at sbp.c:1178"
  },
  "kernel_refs": [
    "sys/dev/disk/sbp/sbp.c:1175",
    "sys/dev/disk/sbp/sbp.c:2637",
    "sys/dev/disk/sbp/sbp.c:2640",
    "sys/dev/disk/sbp/sbp.c:2684",
    "sys/dev/disk/sbp/sbp.c:2705",
    "sys/dev/disk/sbp/sbp.c:1774",
    "sys/bus/firewire/firewire.c:230",
    "sys/bus/firewire/firewire.c:240"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}