{
 "finding_id": "DF-4062",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "Privileged local user trivially panics/wedges the kernel (oversized-allocation path / round_page wrap) or pins tens of GB of zeroed kernel memory per ioctl; kmalloc happens before any controller access.",
 "verdict": "source-verified; hardware-gated (no device on audit guest); no guest run per allocation",
 "exploit_chain": [],
 "evidence": "source-only; path:line citations in pass-2 result block",
 "kernel_refs": [
  "sys/dev/raid/amr/amr.c:501",
  "sys/dev/raid/amr/amr.c:639",
  "sys/dev/raid/amr/amr.c:805"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4062/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "amr_ioctl_buffer_length returns error or clamps for len > 64KB; reject negative int inlen/outlen; cap ap_data_transfer_length; NULL-check the PASS-path kmalloc",
 "fix_evidence": "source-only"
}