{
  "finding_id": "DF-4402",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Certain from source. tws_cam_attach logs but does not return on cam_sim_alloc failure (tws_cam.c:173-175), then calls xpt_bus_register(sc->sim==NULL) at :178 \u2014 xpt_bus_register immediately dereferences sim (sim->lock assert, then sim->bus_id = bus write at sys/bus/cam/cam_xpt.c:4304-4306) -> NULL-pointer write/panic during attach under memory pressure. Additionally the xpt_create_path failure path frees the sim without NULLing sc->sim (:185-193, contrast :180), leaving a latent double-free for any later tws_cam_detach (:211-214), and the tws_bus_scan failure path leaks the registered bus/SIM (:194-198). Hardware-gated: guest has no 3ware HBA.",
  "exploit_chain": "",
  "evidence": "VERDICT.md; fix.diff (return ENOMEM; NULL sc->sim on both failure paths; unwind on scan failure); trigger.c (reproduction conditions)",
  "kernel_refs": [
    "sys/dev/raid/tws/tws_cam.c:173",
    "sys/dev/raid/tws/tws_cam.c:178",
    "sys/dev/raid/tws/tws_cam.c:185",
    "sys/dev/raid/tws/tws_cam.c:211",
    "sys/bus/cam/cam_xpt.c:4304"
  ],
  "poc_changes": "no seed; conditions stub only",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -o trigger trigger.c",
  "run_cmd": "n/a \u2014 attach-path bug; requires cam_sim_alloc to fail on a host with the 3ware HBA",
  "notes": "Checklist item (e) attach error symmetry. Gated on kernel memory pressure at attach; severity Low.",
  "recommended_fix": "Return ENOMEM immediately when cam_sim_alloc fails; NULL sc->sim after cam_sim_free on every failure path; unwind registration on bus-scan failure.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the missing return and symmetric cleanup; not validatable on the guest (no controller, no controllable kmalloc failure at attach).",
  "fix_evidence": "fix.diff",
  "code_hash": "cd3460f87d4548318f684823bcd2fd25850352dc2ec6bf496a540a56915c34d5"
}