# DF-4087 VERDICT

**Status:** untested — hardware-gated (no mps HBA on the audit guest,
`env.txt`); Low-severity logic class, PoC skipped per batch precedent
(mpr twins DF-3916..3919). **Confidence:** certain (source).

- Defect: `sys/dev/raid/mps/mps_mapping.c:512-522` — `PhysicalIdentifier`
  loaded from DPM entry 0 at `:514-516`, never re-read inside the loop at
  `:517-522`; every iteration compares the sought ID against entry 0's value
  while `dpm_entry` walks past it. Byte-for-byte the same defect as mpr
  sibling DF-3916 (`mpr_mapping.c:539-566`), which was filed and source-proven
  in the mpr pass.
- Consequence: DPM lookups fail (or alias to entry 0) whenever the table has
  more than one entry → duplicate DPM allocation via
  `_mapping_get_free_dpm_idx` (`mps_mapping.c:608`, `:1183`),
  double-booked `dpm_entry_used[]` slots, enclosure/volume `dpm_entry_num`
  divergence (`:1177-1226`) → persistent mapping state corruption across
  reboots. All indices remain < `max_dpm_entries`; no OOB — impact is
  correctness/persistence, hence Low.
- Consumers of the lookup: `_mapping_add_new_device` `:1179`,
  `_mapping_update_ir_missing_cnt` `:591` — both only take the lookup result
  as an entry number or BAD_IDX; bounded arrays (`dpm_entry_used`,
  `dpm_flush_entry`, `dpm_pg0` walks) stay in bounds.
- Fix: `fix.diff` re-reads the identifier per iteration (loop body braced).
  Compile-validated: applied to the guest `/usr/src` with the rest of the
  batch's mps fixes; `make` in `sys/dev/raid/mps` with `-Werror` linked
  `mps.ko` (BUILD_EXIT=0; `fix_build.log` in the DF-4085 pack). `/usr/src`
  restored pristine; guest reset with clean-source snapshot.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.