{
  "finding_id": "DF-4332",
  "title": "hptmv read-only GUI ioctls walk array state with no driver lock (UAF race vs DELETE_ARRAY)",
  "verdict": "inconclusive",
  "impact": "none",
  "reproduce": {
    "build": "n/a - requires HighPoint RocketRAID 18xx hardware (absent in guest)",
    "run": "on real HW: two root threads looping HPT_IOCTL_GET_DEVICE_INFO vs HPT_IOCTL_DELETE_ARRAY on the same array via sysctl hw.hptmv.status",
    "expected": "panic in get_array_flag/get_array_info member walk, or VDEV_TO_ID heap pointers in the copyout"
  },
  "kernel_refs": ["sys/dev/raid/hptmv/gui_lib.c:163", "sys/dev/raid/hptmv/gui_lib.c:243", "sys/dev/raid/hptmv/gui_lib.c:496", "sys/dev/raid/hptmv/ioctl.c:316", "sys/dev/raid/hptmv/ioctl.c:219"],
  "artifacts": ["README.md", "VERDICT.md", "verdict.json", "manifest.json", "env.txt"]
}