{
  "finding_id": "DF-4561",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "UNTESTED at the driver level (requires an LSI IR HBA; the QEMU guest has none) \u2014 but the defect is deterministic loop arithmetic proven from source: mpssas_ir_shutdown scans id in [start_idx, end_idx) (mps_sas_lsi.c:904) while end_idx = start_idx + max_volumes - 1 (mps_sas_lsi.c:902) is the INCLUSIVE last slot of the IR map range (identical formula in _mapping_get_ir_maprange, mps_mapping.c:234, consumed inclusively at mps_mapping.c:366). Only max_volumes-1 slots are checked; a volume in the final slot is never seen, found_volume stays 0, and MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED is never sent \u2014 unflushed volume write cache at poweroff. Coverage arithmetic executed on the guest (tail of findings/poc/DF-4560/run.log): range [256..263], loop visits 7, slot 263 never checked. Data-integrity impact only; rated Low.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4560/run.log tail (IR range [256..263] (8 slots); loop visits 7, last visited 262 -> slot 263 ... NEVER checked); fix.diff (one-token change); VERDICT.md source trace.",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_sas_lsi.c:902",
    "sys/dev/raid/mps/mps_sas_lsi.c:904",
    "sys/dev/raid/mps/mps_mapping.c:234",
    "sys/dev/raid/mps/mps_mapping.c:366"
  ],
  "poc_changes": "No standalone PoC: no runtime behavior exists beyond the loop arithmetic without hardware; coverage computation folded into the DF-4560 harness run on the guest.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o df4560 df4560_harness.c (coverage arithmetic printed by ./df4560)",
  "run_cmd": "./df4560 (last section)",
  "code_hash": "",
  "notes": "untested is the honest status: the arithmetic is certain, but exercising the shipped path needs an mps controller with IR firmware and a volume in the last IR slot. Low severity, data-integrity only.",
  "recommended_fix": "Change the loop bound at mps_sas_lsi.c:904 from id < end_idx to id <= end_idx.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Pure one-token loop-bound change (fix.diff); arithmetic self-evident \u2014 with id <= end_idx the scan visits exactly max_volumes slots.",
  "fix_evidence": "fix.diff; coverage arithmetic in findings/poc/DF-4560/run.log."
}