{
  "finding_id": "DF-3984",
  "title": "sbp(4): address-only ORB matching across ORB recycling lets a replayed mgm status complete a recycled command ORB (premature dmamap_unload under live DMA, spurious CAM completion)",
  "verdict": "inconclusive_source_likely_hardware_gated",
  "impact_ceiling": "device DMA into unmapped/reused pages after dmamap_unload + wrong-data CAM_REQ_CMP completions",
  "reproduce": {
    "build": "n/a (needs FireWire hardware)",
    "run": "SBP device: answer login (mgm ORB slot X), wait for slot X to be reused by a command ORB, then replay the identical mgm status write (same orb_lo) to the initiator status FIFO",
    "expected": "sbp_dequeue_ocb matches the command ORB by address; dmamap_unload while the command is in flight; CCB completes with attacker-chosen status"
  },
  "kernel_refs": [
    "sys/dev/disk/sbp/sbp.c:156",
    "sys/dev/disk/sbp/sbp.c:516",
    "sys/dev/disk/sbp/sbp.c:1597",
    "sys/dev/disk/sbp/sbp.c:1605",
    "sys/dev/disk/sbp/sbp.c:1782",
    "sys/dev/disk/sbp/sbp.c:2584",
    "sys/dev/disk/sbp/sbp.c:2597"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}