{
  "finding_id": "DF-4021",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "confidence": "certain",
  "impact": "mpr_user_btdh off-by-one: target > max_devices (mpr_user.c:2240) lets TargetID==max_devices read mapping_table[max_devices] one 24-byte element past the heap allocation (mpr_mapping.c:2140-2141 allocates exactly max_devices entries), disclosing a garbage u16 dev_handle (byte offset 18 of the element) to the operator-group caller (mpr_user.c:2245-2247, node mpr_user.c:205). Twin of DF-4016 (mps).",
  "verdict": "source-verified; HW-gated (needs attached mpr(4) HBA; PoC skipped per contract for Low)",
  "exploit_chain": [],
  "evidence": "source-only; path:line citations in README.md; mps twin evidence at findings/poc/DF-4016/",
  "kernel_refs": [
    "sys/dev/raid/mpr/mpr_user.c:2240",
    "sys/dev/raid/mpr/mpr_user.c:2245",
    "sys/dev/raid/mpr/mpr_mapping.c:2140",
    "sys/dev/raid/mpr/mprvar.h:113"
  ],
  "guest_uname": "",
  "code_hash": "",
  "artifact_dir": "findings/poc/DF-4021/",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "change the check at mpr_user.c:2240 from target > sc->max_devices to target >= sc->max_devices (and the mps twin at mps_user.c:2021)",
  "fix_evidence": "source-only"
}