{
 "finding_id": "DF-4575",
 "poc_id": "DF-4575",
 "status": "untested",
 "reproduced": 0,
 "impact": "Kernel DoS: 10s interrupts-disabled spin then unconditional panic on raced mailbox (or wedged chip during timeout recovery); torn param can BDR the wrong target",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "One RISC idle-command mailbox shared across sim-lock, crit-only callout, and lock-free ISR callers with no serialization; unpriv userspace drives it via queue saturation to a stalled target + concurrent resets. idle_lock + error-return-instead-of-panic fix.",
 "kernel_refs": [
  "sys/dev/disk/advansys/adwlib.c:856",
  "sys/dev/disk/advansys/adwlib.c:862",
  "sys/dev/disk/advansys/adwlib.c:871",
  "sys/dev/disk/advansys/adwlib.c:888"
 ],
 "verdict": "not_run: requires adw(4) HBA + stalled/malicious SCSI target",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: hardware absent from guest",
 "fix_evidence": "fix in finding markdown"
}