{
  "finding_id": "DF-4075",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, chip-gated (needs an mps-attached LSI IOC that stops answering). mps_request_polled() has no timeout cancellation: after 1000x50ms it returns ETIMEDOUT while the command is still posted to the controller. (i) mps_update_events():1719-1724 then calls mps_print_event(sc, reply) with reply == cm->cm_reply == NULL (mps_free_command zeroes it, mpsvar.h:520) and mps_print_event() dereferences event->EventDataLength unconditionally (mps_table.c) => NULL-deref panic. (ii) Both polled callers free the still-posted command on the error path (mps_get_portfacts:592-594 done:, mps_update_events:1727); a late reply then lands on a freed/reallocated cm via mps_intr_locked:1581 -> spurious completion/wakeup of the new owner and a stale reply busaddr recycled by mps_free_reply (mpsvar.h:518-519) => reply-frame double-recycle and command-state corruption. Distinct from DF-4014 (user-ioctl wait path / DMA-buffer UAF) and DF-1369 (SMID validation).",
  "exploit_chain": "",
  "evidence": "mps.c:2150-2157 timeout loop leaves cm live; :1720-1724 NULL print; :592-596 and :1727 free-on-timeout; mpsvar.h:514-540 free semantics",
  "kernel_refs": [
    "sys/dev/raid/mps/mps.c:1724",
    "sys/dev/raid/mps/mps.c:2150",
    "sys/dev/raid/mps/mps.c:1581",
    "sys/dev/raid/mps/mpsvar.h:520"
  ],
  "poc_changes": "n/a (source-level; no mps controller on the guest)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level finding)",
  "run_cmd": "n/a (hardware-gated; source-level analysis)",
  "code_hash": null,
  "notes": "Guest has no LSI mps HBA => not runnable; would be panic (i) or state corruption (ii).",
  "recommended_fix": "NULL-guard the mps_print_event call; on polled timeout do not let callers free a still-posted command (complete it with error / mark and reclaim on reinit).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
  "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}