{
  "finding_id": "DF-4137",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "remove_plex_entry compacts vol->plex[] with a byte count instead of sizeof(int) elements (vinumconfig.c:1850-1852 vs the correct twin at :1780-1782) and decrements vol->plexes even when the plex was not found (:1844-1853). For plex indices >=256 the volumes plex list silently points at wrong plexes (I/O routed to a foreign plex); repeated not-found removals can drive vol->plexes negative leading to writes before vol->plex[] in give_plex_to_volume (:205). Live test skipped: needs >=256 allocated plexes or DF-1399-state to matter.",
  "exploit_chain": "",
  "evidence": "README.md analysis",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumconfig.c:1841",
    "sys/dev/raid/vinum/vinumconfig.c:1850",
    "sys/dev/raid/vinum/vinumconfig.c:1780"
  ],
  "poc_changes": "n/a - analysis only",
  "attempts": 0,
  "guest_uname": "n/a",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "notes": "",
  "recommended_fix": "Multiply the bcopy length by sizeof(int) and only decrement vol->plexes when the plex was found.",
  "fix_status": "not_applicable"
}