{
  "finding_id": "DF-4088",
  "status": "untested",
  "reproduced": 0,
  "impact": "mapping-table/persistence corruption (logic class); no direct OOB",
  "confidence": "certain",
  "verdict": "Low - PoC skipped per contract (hardware-gated logic class, mpr twin DF-3917 precedent). Source-certain triple defect in _mapping_find_enc_map_space: (1) :847 clears the NEW enclosure (et_entry) instead of the evicted overlapping one (enc_entry) during table defragmentation; (2) :829-831 overlap test is off by one (map_idx > start+num_slots lets the first slot PAST the enclosure be evicted/cleared); (3) :862 resets et_entry->skip_search where enc_entrys flag was set at :802, and num_found is stale (not reset at :808) so the third search loops start_idx undershoots the free run. Net: enclosure metadata zeroed, map slots stolen from neighbor enclosures, corrupted num_slots/start_slot feed the known DF-1375 slot arithmetic. All writes stay within the tables. Fix authored; module compile-validated with the batch.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-by-line + mpr:1075-1121 cross-check), fix.diff (4 hunks), fix_build.log in DF-4085 pack",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_mapping.c:802",
    "sys/dev/raid/mps/mps_mapping.c:808",
    "sys/dev/raid/mps/mps_mapping.c:815",
    "sys/dev/raid/mps/mps_mapping.c:829",
    "sys/dev/raid/mps/mps_mapping.c:845",
    "sys/dev/raid/mps/mps_mapping.c:847",
    "sys/dev/raid/mps/mps_mapping.c:862"
  ],
  "poc_changes": "n/a (untested)",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "mps twin of DF-3917 (mpr_mapping.c:1075-1121 carries the identical defects).",
  "recommended_fix": "Clear enc_entry (not et_entry) at the eviction point, use >= in the overlap skip test, reset enc_entry->skip_search, and zero num_found before the post-eviction search loop.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Applied to the guest /usr/src together with this batchs other mps fixes (DF-4085..DF-4090); make in sys/dev/raid/mps compiled all sources with -Werror and linked mps.ko (BUILD_EXIT=0). Runtime fix validation not testable: the path requires an mps(4) HBA delivering firmware data, absent on this guest.",
  "fix_evidence": "findings/poc/DF-4088/fix.diff, findings/poc/DF-4085/fix_build.log"
}