{
  "finding_id": "DF-4077",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, chip-gated. The reply-pointer recomposition check in mps_intr_locked() at mps.c:1541-1543 rejects only reply > reply_frames + fqdepth*ReplyFrameSize*4; a chip-supplied ReplyFrameAddress equal to exactly the one-past-end value passes and is then dereferenced as MPI2_DEFAULT_REPLY* => OOB read past the reply_frames DMA map. Valid frame addresses end one frame earlier; the bound must be >= end - ReplyFrameSize*4 (or reject non-frame-aligned addresses). One-frame OOB read of chip-influenced length (MsgLength) consumed by print/complete paths.",
  "exploit_chain": "",
  "evidence": "mps.c:1541-1552: reply > (reply_frames + fqdepth*ReplyFrameSize*4) accepts reply == end",
  "kernel_refs": [
    "sys/dev/raid/mps/mps.c:1541",
    "sys/dev/raid/mps/mps.c:1533"
  ],
  "poc_changes": "n/a (source-level)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level finding)",
  "run_cmd": "n/a (hardware-gated; source-level analysis)",
  "code_hash": null,
  "notes": "Adjacent to DF-1369 (SMID) but a distinct, unchecked quantity (ReplyFrameAddress).",
  "recommended_fix": "Tighten the bound: reply >= reply_frames + (fqdepth-1)*ReplyFrameSize*4 (or check alignment + last-frame exclusion).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
  "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}