{
  "finding_id": "DF-4438",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Kernel-path reproduction impossible on the audit guest (no LSI/Avago MR controller: pciconf shows no vendor-1000 devices, no /dev/mrsas*, no hw.mrsas sysctl). The flaw itself is statically certain: mrsas_cam_attach error paths (mrsas_cam.c:150-156, 157-165, 181-185, 186-193) cam_sim_free() sim_0/sim_1 without clearing sc->sim_0/sc->sim_1; mrsas_attach (mrsas.c:838-839) then unwinds via mrsas_cam_detach, which re-processes the dangling pointers: cam_sim_path() UAF read + second xpt_bus_deregister + cam_sim_free() double free into M_CAMSIM plus devq refcount underflow. A userspace mirror of the exact choreography, compiled and run on the DragonFly guest (cc 8.3), flags both violations in buggy mode and is clean with the one-line fix (run.log).",
  "exploit_chain": "",
  "evidence": "run.log: sim UAF: cam_sim_path() on freed cam_sim + sim DOUBLE FREE: cam_sim_release()/kfree() on already-freed cam_sim (buggy, rc=2) vs RESULT: clean (fixed, rc=0); env.txt documents guest device absence; VERDICT.md has the full path:line trace (mrsas.c:805->838-839 -> mrsas_cam.c:216-218; cam_sim.c:231-251 frees at refcount==1).",
  "kernel_refs": [
    "sys/dev/raid/mrsas/mrsas_cam.c:150",
    "sys/dev/raid/mrsas/mrsas_cam.c:153",
    "sys/dev/raid/mrsas/mrsas_cam.c:162",
    "sys/dev/raid/mrsas/mrsas_cam.c:182",
    "sys/dev/raid/mrsas/mrsas_cam.c:190",
    "sys/dev/raid/mrsas/mrsas_cam.c:216",
    "sys/dev/raid/mrsas/mrsas_cam.c:217",
    "sys/dev/raid/mrsas/mrsas_cam.c:218",
    "sys/dev/raid/mrsas/mrsas.c:805",
    "sys/dev/raid/mrsas/mrsas.c:839",
    "sys/bus/cam/cam_sim.c:182",
    "sys/bus/cam/cam_sim.c:231",
    "sys/bus/cam/cam_sim.c:243"
  ],
  "poc_changes": "No seed PoC existed (pass-2 finding discovered in this run); wrote repro_logic.c as a userspace mirror of the kernel refcount/unwind choreography since the trigger needs absent hardware.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 8,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o repro_logic repro_logic.c",
  "run_cmd": "./repro_logic buggy; ./repro_logic fixed",
  "code_hash": "dae766cd77380349b7b2d2292a4036ba30a210a94420e79fa3491f5ab60bed3d",
  "notes": "Guest has no mrsas/cxm hardware (env.txt); trigger = driver-attach resource failure (xpt_bus_register/xpt_create_path ENOMEM) with an LSI Thunderbolt controller present. sim_1==NULL path at mrsas_cam.c:175-178 is dead code (cam_sim_alloc uses M_INTWAIT) and also leaks the caller devq ref - covered by fix.diff. Guest left clean (only /tmp/df4438 scratch).",
  "recommended_fix": "NULL sc->sim_0/sc->sim_1 after error-path cam_sim_free() calls in mrsas_cam_attach (and defensively in mrsas_cam_detach) so mrsas_attachs attach_fail_cam unwind cannot double-free; release the callers devq ref on the sim_1-alloc-failure path.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Kernel fix validation not testable: the guest has no LSI MR controller, and the bug requires attach-time CAM resource failure with the device present. The mirrors fixed mode (sc->sim_X = NULL after free) shows both violations eliminated; fix.diff applies cleanly against sys/dev/raid/mrsas/mrsas_cam.c.",
  "fix_evidence": "run.log fixed-mode section: RESULT: clean (no UAF / double free detected), exit 0; fix.diff in this pack."
}