{
 "finding_id": "DF-4391",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "The alloc validates only the second kmalloc; if request_desc_pool fails while the pool-array succeeds, the setup loop stores cmd->request_desc = NULL + i and the first command issue memsets at address 16*index - a write into the unmapped low page, panicking the boot",
 "verdict": "source-verified; hardware-gated",
 "exploit_chain": [],
 "evidence": "source-only; path:line citations in pass-2 result block",
 "kernel_refs": [
  "sys/dev/raid/mfi/mfi_tbolt.c:455"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4391/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "see pass-2 result block fix",
 "fix_evidence": "source-only"
}