{
  "finding_id": "DF-4438",
  "title": "mrsas_cam_attach error paths free sim_0/sim_1 without clearing sc->sim_0/sc->sim_1; mrsas_attach's attach_fail_cam unwind calls mrsas_cam_detach which double-frees the cam_sim (M_CAMSIM) after a cam_sim_path() UAF read and a second xpt_bus_deregister",
  "verdict": "inconclusive",
  "impact": "none (not kernel-triggerable on this guest: no LSI MR controller)",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -Wall -o repro_logic repro_logic.c  (on DragonFly guest)",
    "run": "./repro_logic buggy ; ./repro_logic fixed",
    "expected": "buggy mode prints 'sim UAF: cam_sim_path() on freed cam_sim' and 'sim DOUBLE FREE: cam_sim_release()/kfree() on already-freed cam_sim' and exits 2; fixed mode prints RESULT: clean and exits 0"
  },
  "kernel_refs": [
    "sys/dev/raid/mrsas/mrsas_cam.c:150",
    "sys/dev/raid/mrsas/mrsas_cam.c:157",
    "sys/dev/raid/mrsas/mrsas_cam.c:181",
    "sys/dev/raid/mrsas/mrsas_cam.c:186",
    "sys/dev/raid/mrsas/mrsas_cam.c:216",
    "sys/dev/raid/mrsas/mrsas.c:805",
    "sys/dev/raid/mrsas/mrsas.c:838",
    "sys/bus/cam/cam_sim.c:231"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "repro_logic.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}