{
 "finding_id": "DF-4015",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "mps_user_command leaks one mps_command per timed-out MPSIO_MPS_COMMAND (goto Ret skips RetFreeUnlocked) - operator drains the finite command pool shared with SCSI I/O -> ENOMEM for management ioctls and eventual I/O starvation of the boot disk.",
 "verdict": "source-verified; HW-gated (needs mps adapter + slow FW)",
 "exploit_chain": [],
 "evidence": "source-only; path:line citations in pass-2 result block",
 "kernel_refs": [
  "sys/dev/raid/mps/mps_user.c:705",
  "sys/dev/raid/mps/mps_user.c:733"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4015/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "free/reclaim the command once provably no longer in flight (folded into the DF-4014 abandon-policy fix)",
 "fix_evidence": "source-only"
}