{
  "finding_id": "DF-4558",
  "verdict": "not_reproduced",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "none - trigger is kldunload(8) on a modular atapicam.ko system",
    "run": "kldload atapicam; keep cd0 probed; kldunload atapicam; dd if=/dev/cd0 of=/dev/null bs=2k count=1",
    "expected": "on an affected modular system: kfree of softc while BUS_REGISTERED still set (\"Can't free ... SIM\" on console), subsequent cd0 I/O hits atapi_action on freed softc (UAF). NOT runnable on the audit guest: natapicam is compiled into X86_64_GENERIC (no module to unload)."
  },
  "kernel_refs": [
    "sys/dev/disk/nata/atapi-cam.c:916",
    "sys/dev/disk/nata/atapi-cam.c:925",
    "sys/dev/disk/nata/atapi-cam.c:927",
    "sys/dev/disk/nata/atapi-cam.c:894",
    "sys/dev/disk/nata/atapi-cam.c:900",
    "sys/dev/disk/nata/atapi-cam.c:906",
    "sys/kern/subr_bus.c:1788"
  ],
  "artifacts": ["README.md","VERDICT.md","run.sh","build.sh","fix.diff","manifest.json","verdict.json"]
}