{
  "finding_id": "DF-4330",
  "title": "mrsas mr_update_span_set OOB kernel write via firmware spanDepth",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "sh build.sh  (guest root; builds unpatched + fix.diff-patched probe KLDs embedding the real mrsas_fp.c)",
    "run": "kldload /root/fp4330/fp_probe.ko; sysctl hw.fp_probe_run=0; sysctl hw.fp_probe_run=1",
    "expected": "mode0: accepted+guard clean; mode1: accepted + 'DF-4330 CONFIRMED: OOB WRITE past end of sc->log_to_span[64]' + 40/4096 guard bytes clobbered; patched module: mode1 rejected, guard clean"
  },
  "kernel_refs": ["sys/dev/raid/mrsas/mrsas_fp.c:949", "sys/dev/raid/mrsas/mrsas_fp.c:955", "sys/dev/raid/mrsas/mrsas_fp.c:257", "sys/dev/raid/mrsas/mrsas.h:733", "sys/dev/raid/mrsas/mrsas.h:2424", "sys/dev/raid/mrsas/mrsas.c:1762", "sys/dev/raid/mrsas/mrsas.c:2961"],
  "artifacts": ["fp_probe.c", "rename.h", "Makefile", "build.sh", "run.sh", "fix.diff", "build.log", "run.log", "fix_build.log", "fix_run.log", "serial_decisive.log", "VERDICT.md", "README.md", "verdict.json", "manifest.json", "env.txt"]
}