{
  "finding_id": "DF-4179",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Pure source-level off-by-one: twe_add_unit checks unit > TWE_MAX_UNITS (twe.c:212) instead of >=, so TWEIO_ADD_UNIT with td_unit==16 passes and dr=&sc->twe_drive[16] (twe.c:226) is one struct twe_drive past the 16-element array (twevar.h:136) - it overlays sc->twe_aen_queue[]. If the controllers unit-summary byte at data[16] (twe.c:228) reports online, controller-derived geometry is written out of bounds (td_size twe.c:236, td_state/td_type/heads/sectors/cylinders/td_twe_unit twe.c:242-272) and twe_attach_drive writes an 8-byte device_t OOB and creates a ghost twed unit whose td_twe_unit==16 is truncated into the 4-bit cmd->io.unit field (twe.c:448), directing that disks I/O at unit 0. Not exercisable on this guest: no 3ware controller, open(/dev/twe0) = ENOENT (run.log); control node 0600 root:operator.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line trace incl. the >= twin in twe_del_unit twe.c:291 proving intent); twe_addunit16.c (trigger: TWEIO_ADD_UNIT 16); run.log (hardware absent, build OK); fix.diff + fix_build.log",
  "kernel_refs": [
    "sys/dev/raid/twe/twe.c:212",
    "sys/dev/raid/twe/twe.c:226",
    "sys/dev/raid/twe/twe.c:228",
    "sys/dev/raid/twe/twe.c:236",
    "sys/dev/raid/twe/twe.c:448",
    "sys/dev/raid/twe/twevar.h:136",
    "sys/dev/raid/twe/twereg.h:144"
  ],
  "poc_changes": "n/a (first-pass PoC authored in this run)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 15,
  "guest_dirty": 1,
  "build_cmd": "cc -O -Wall -o twe_addunit16 twe_addunit16.c",
  "run_cmd": "./twe_addunit16 /dev/twe0 16",
  "code_hash": "e0d1984fdda0bb52ff1d746b25837feec69f5a601be83288983d39650a3a23f5",
  "notes": "HW-gated (controller data gates the write) + root-gated. Ghost unit also never cleaned: twe_shutdown iterates i<TWE_MAX_UNITS (twe_freebsd.c:471) and twe_del_unit(16) is rejected by the correct >= check.",
  "recommended_fix": "Change the bound at twe.c:212 from unit > TWE_MAX_UNITS to unit >= TWE_MAX_UNITS.",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Compile-validated only: one-line fix applied cleanly and batch-built into X86_64_GENERIC with -Werror, rc=0 (fix_build.log). On hardware the PoCs success criterion flips from ioctl()==0 to -EINVAL; could not be behaviorally tested on this guest (no 3ware controller).",
  "fix_evidence": "fix_build.log excerpt; grep unit >= TWE_MAX_UNITS verified present at twe.c:212 in the patched tree before the build."
}