{
  "finding_id": "DF-4090",
  "status": "untested",
  "reproduced": 0,
  "impact": "none (functional: DPM entries silently under-read; overflow direction provably impossible)",
  "confidence": "certain",
  "verdict": "Low - integer truncation with proven-benign direction, PoC not meaningful. mps_mapping_initialize declares uint16_t dpm_pg0_sz (:1721) and assigns 8 + max_dpm_entries*20 (:1774-1776); for MaxPersistentEntries >= 3277 the u16 wraps and the DPM read at :1780 uses the truncated (smaller) size. mps_config_get_dpm_pg0 memsets and bcopies with MIN(cm->cm_length, sz) (mps_config.c:541,635) so the copy is always bounded by sz into the full-size M_ZERO allocation - under-read only (persistent entries beyond ~3275 read as zero/unused). The sz parameter plumbing is u16 in mps_config.c:530 and mpsvar.h:719; fix widens all three to u32 and compile-validates with the batch.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (truncation + MIN() bound analysis), fix.diff (3 files), fix_build.log in DF-4085 pack",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_mapping.c:1721",
    "sys/dev/raid/mps/mps_mapping.c:1774",
    "sys/dev/raid/mps/mps_mapping.c:1780",
    "sys/dev/raid/mps/mps_config.c:635",
    "sys/dev/raid/mps/mpsvar.h:719"
  ],
  "poc_changes": "n/a (untested)",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Checklist item (d) cross-apply; direction analysis proves no memory-safety impact.",
  "recommended_fix": "Widen dpm_pg0_sz and mps_config_get_dpm_pg0s sz parameter to u32.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Applied to the guest /usr/src together with this batchs other mps fixes (DF-4085..DF-4090); make in sys/dev/raid/mps compiled all sources with -Werror and linked mps.ko (BUILD_EXIT=0). Runtime fix validation not testable: the path requires an mps(4) HBA delivering firmware data, absent on this guest.",
  "fix_evidence": "findings/poc/DF-4090/fix.diff, findings/poc/DF-4085/fix_build.log"
}