{
  "finding_id": "DF-4309",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated. adwallocacbs() creates one bus_dmamap per ACB (bus_dmamap_create(adw->buffer_dmat, &next_acb->dmamap), adwcam.c:205-206) but adw_free() (adwcam.c:843-886) never destroys them: case 9 frees the sg maps, cases 8/7 free the acb array, case 2 destroys buffer_dmat itself (adwcam.c:878) with all per-ACB maps still live. Every adw_free() (detach, kldunload, failed attach) leaks up to ADW_DEF_MAX_HOST_QNG=253 dma maps and destroys their tag out from under them. Resource-leak / cleanup-asymmetry only (privileged repeat path), no direct memory-safety impact — Info severity. Guest has no Advansys HBA, so no runtime reproduction.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4309/VERDICT.md; creation adwcam.c:205-206; teardown switch adwcam.c:846-883 (no per-acb dmamap destroy); tag destroyed at adwcam.c:878",
  "kernel_refs": [
    "sys/dev/disk/advansys/adwcam.c:205",
    "sys/dev/disk/advansys/adwcam.c:846",
    "sys/dev/disk/advansys/adwcam.c:878"
  ],
  "poc_changes": "No seed PoC (finding new in pass 2). Hardware-gated.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 lens (e): attach error paths / teardown symmetry. init_level accounting itself verified CORRECT (two increments in adw_pci.c:263,272 complete the 9 levels; an initial pass-2 hypothesis that case 8/9 were dead was disproven).",
  "recommended_fix": "Destroy the per-ACB buffer maps in adw_free() case 9 before the tag teardown — see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch -p1 apply-verified); cannot be runtime-tested without Advansys hardware.",
  "fix_evidence": "findings/poc/DF-4309/fix.diff"
}