{
  "finding_id": "DF-4173",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Bug certain from code trace, not runtime-testable: iir_shutdown (shutdown_post_sync handler) allocates one gdt_ucmd_t (iir.c:1493), reuses it across all host drives - re-queueing it for drive N+1 while drive Ns dispatch still owns it if the 10s tsleep expires (iir.c:1514) - and unconditionally kfrees it with the wrong type (M_DEVBUF vs M_GDTBUF, iir.c:1518) while an in-flight gccb may still hold gc_ucmd pointing at it. The later GDT_GCF_IOCTL completion then writes ucmd->status/info/complete_flag (iir.c:1608-1610), bcopies up to 3KB into the freed ucmd->data (iir.c:1613-1626), TAILQ-links the freed object on the BSY path (iir.c:1604) and wakeups it (iir.c:1632): use-after-free heap write at shutdown. Guest has no iir controller (gate_check.log) so the driver never attaches.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full path:line trace); gate_check.log (hardware absent); fix.diff (per-drive ucmd, free-only-complete, correct type, git apply --check clean)",
  "kernel_refs": [
    "sys/dev/raid/iir/iir.c:1493",
    "sys/dev/raid/iir/iir.c:1509",
    "sys/dev/raid/iir/iir.c:1514",
    "sys/dev/raid/iir/iir.c:1518",
    "sys/dev/raid/iir/iir.c:1600",
    "sys/dev/raid/iir/iir.c:1604",
    "sys/dev/raid/iir/iir.c:1608",
    "sys/dev/raid/iir/iir.c:1615"
  ],
  "poc_changes": "no PoC source written: the defect is in the system-shutdown handler and requires a controller that stalls >=10s on GDT_FLUSH; only a hardware gate check was run",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "none (no userland trigger)",
  "run_cmd": "sh gate_check.sh",
  "code_hash": "6cd1cb94653995c48b8597068012f2693c49edbc21870d9a991f2fa2c80532e8",
  "notes": "Hardware-gated shutdown-path UAF (memcorrupt bucket, Low severity). Guest artifacts removed after capture; guest left clean and up.",
  "recommended_fix": "Allocate one ucmd per host drive, free only completed ones with M_GDTBUF, never free/requeue an in-flight ucmd (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff restructures the flush loop (per-drive ucmd + correct free discipline) and passes git apply --check; runtime validation requires iir hardware",
  "fix_evidence": "findings/poc/DF-4173/fix.diff (git apply --check clean)"
}