{
  "finding_id": "DF-4087",
  "status": "untested",
  "reproduced": 0,
  "impact": "mapping-table/persistence corruption (logic class); no direct OOB",
  "confidence": "certain",
  "verdict": "Low - PoC skipped per contract (hardware-gated logic class, mpr twin DF-3916 precedent). Source-certain: _mapping_get_dpm_idx_from_id (mps_mapping.c:512-522) loads the 64-bit PhysicalIdentifier once from DPM entry 0 and never re-reads it inside the loop, so every candidate entry is compared against entry 0s identifier; DPM lookups only ever match entry 0, all other IDs return BAD_IDX and get duplicate entries via _mapping_get_free_dpm_idx -> persistent-mapping double-booking/divergence. All indices stay < max_dpm_entries; correctness impact. Fix authored; module compile-validated with the batch.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-by-line), fix.diff, fix_build.log in DF-4085 pack (same -Werror module build)",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_mapping.c:512",
    "sys/dev/raid/mps/mps_mapping.c:514",
    "sys/dev/raid/mps/mps_mapping.c:517",
    "sys/dev/raid/mps/mps_mapping.c:519"
  ],
  "poc_changes": "n/a (untested)",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "mps twin of DF-3916 (mpr_mapping.c:539-566), identical defect.",
  "recommended_fix": "Re-read PhysicalIdentifier from dpm_entry inside the per-entry loop.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Applied to the guest /usr/src together with this batchs other mps fixes (DF-4085..DF-4090); make in sys/dev/raid/mps compiled all sources with -Werror and linked mps.ko (BUILD_EXIT=0). Runtime fix validation not testable: the path requires an mps(4) HBA delivering firmware data, absent on this guest.",
  "fix_evidence": "findings/poc/DF-4087/fix.diff, findings/poc/DF-4085/fix_build.log"
}