{
  "finding_id": "DF-4061",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "confidence": "certain",
  "impact": "Control-flow nondeterminism on a root-only surface: stack-garbage-chosen opcode/mailbox/pointers; no exfiltration (4-byte copy-back returns the users own inlen).",
  "verdict": "source-verified; hardware-gated (no device on audit guest); no guest run per allocation",
  "exploit_chain": [],
  "evidence": "source-only; path:line citations in pass-2 result block",
  "kernel_refs": [
    "sys/dev/raid/amr/amr.c:765",
    "sys/dev/raid/amr/amr.c:533"
  ],
  "guest_uname": "",
  "code_hash": "",
  "artifact_dir": "findings/poc/DF-4061/",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "reject 0xc0046d00 (or check IOCPARM_LEN(cmd) == sizeof(struct amr_linux_ioctl)) before the copyin",
  "fix_evidence": "source-only"
}