{
  "finding_id": "DF-4211",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "mpt_refresh_raid_vol frees a request on ETIMEDOUT that is still queued to the IOC and linked on request_pending_list (mpt_raid.c:1332). Every sibling helper leaves it for the late-reply path; here the request returns to the free list while in flight, so it is handed to a new command and the late RAID-action reply (context = index|raid_handler_id) completes/frees the new owners request -> double-link corruption / UAF. Hardware-gated: guest has no MPT HBA (env.txt), so untested at runtime; the protocol violation itself is line-certain.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4211/VERDICT.md (line-level trace), findings/poc/DF-4211/env.txt (guest pciconf: no MPT HBA), findings/poc/DF-4211/fix.diff",
  "kernel_refs": [
    "sys/dev/disk/mpt/mpt_raid.c:1327",
    "sys/dev/disk/mpt/mpt_raid.c:1332",
    "sys/dev/disk/mpt/mpt_raid.c:977",
    "sys/dev/disk/mpt/mpt.c:1356",
    "sys/dev/disk/mpt/mpt.c:1298",
    "sys/dev/disk/mpt/mpt.c:1213",
    "sys/dev/disk/mpt/mpt.c:520",
    "sys/dev/disk/mpt/mpt_raid.c:545"
  ],
  "poc_changes": "no runnable PoC: path requires LSI MPT Fusion RAID hardware absent from the audit guest (env.txt)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Trigger needs the controller to answer a RAID action slower than the 2s poll window during volume resync \u2014 same fw/hw-fault trust boundary as DF-1449/DF-2484/DF-2485 but a distinct bug class (request lifecycle vs index validation).",
  "recommended_fix": "do not free the request on ETIMEDOUT; let the late reply reclaim it via mpt_raid_reply_handler",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": null,
  "fix_evidence": null
}