# DF-4088 VERDICT

**Status:** untested — hardware-gated (no mps HBA on the audit guest,
`env.txt`); Low-severity mapping-state-corruption class, PoC skipped per
batch precedent (mpr twin DF-3917 was likewise source-only).
**Confidence:** certain (all three defects verified line-by-line against
`sys/dev/raid/mps/mps_mapping.c` and cross-checked to be identical in
`sys/dev/raid/mpr/mpr_mapping.c:1075-1121`).

- Wrong-variable clear: `mps_mapping.c:847`
  `_mapping_clear_enc_entry(et_entry)` inside the `enc_entry` eviction loop
  (loop head `:826-828`, eviction bookkeeping `:833-844`). `_mapping_clear_enc_entry`
  zeroes `num_slots`, `start_slot`, `enclosure_id`, `phy_bits`,
  `dpm_entry_num` (`:83-97`) of the enclosure **being added**, while the
  evicted enclosure's entry is left with live `start_index` but its map
  entries cleared — divergence on both sides. The caller assigns
  `et_entry->start_index = map_idx` afterwards (`:974`), masking one symptom.
- Off-by-one: `:829-831` ownership is `[start, start+num_slots)` but the skip
  test allows `map_idx == start+num_slots` → one map entry past the enclosure
  gets `_mapping_clear_map_entry()`'d (`:838-844`) — that entry belongs to
  whatever enclosure follows.
- Stale accumulator: `num_found` survives from the `:783-794` loop into the
  `:809-820` loop (`found_space = 0` reset at `:808` but not `num_found`),
  so `start_idx = map_idx - num_found + 1` (`:815`) undershoots the free run
  and the caller's reservation loop (`:993-998`) marks still-owned entries
  `MPS_DEV_RESERVED`.
- Blast radius: all indices generated here remain `< end_of_table ≤
  max_devices` (`:762-767`), so no OOB *inside this function*; the corrupted
  `num_slots`/`start_slot` then flow into `_mapping_add_new_device:1165`
  (whose missing bounds are the already-filed DF-1375) and into
  `_mapping_commit_enc_entry` — persistence and mapping-correctness impact,
  Low severity on its own.
- Fix: `fix.diff` (4 hunks, all inside `_mapping_find_enc_map_space`).
  Compile-validated: applied to the guest `/usr/src` with the rest of the
  batch's mps fixes; `make` in `sys/dev/raid/mps` with `-Werror` linked
  `mps.ko` (BUILD_EXIT=0; `fix_build.log` in the DF-4085 pack). `/usr/src`
  restored pristine; guest reset with clean-source snapshot.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.