{
 "finding_id": "DF-4210",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "likely",
 "impact": "In the RQSTYPE_NOTIFY default case, ISP_SNPRINTF overwrites the just-parsed Immediate Notify entry in the 64-byte stack buffer with an ASCII log message; isp_print_bytes correctly prints the ORIGINAL entry (vptr) but isp_notify_ack(isp, local) is handed the STRING, which it re-parses as in_entry_t - na_iid/na_seqid/na_status/na_task_flags become ASCII bytes and that garbage Notify-Ack goes to the firmware queue",
 "verdict": "source-verified; hardware-gated (no ath NIC / no ISP_TARGET_MODE kernel on audit guest)",
 "exploit_chain": [],
 "evidence": "source-only; full path:line trace in pass-2 result block",
 "kernel_refs": [
  "sys/dev/disk/isp/isp_target.c:346"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4210/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "see pass-2 result block fix",
 "fix_evidence": "source-only"
}