# DF-4597 — VERDICT

**Status: untested** (code-certain logic bug; multi-drive setup not built on
the guest for it — the mechanism is a two-line reading of the loop).

## Analysis

`sys/dev/raid/vinum/vinumio.c:601-606`: inside
`for (driveno = 0; driveno < vinum_conf.drives_allocated; driveno++)`, the
malformed-drive branch executes `free_drive(drive); break;` — terminating the
save pass for all remaining drives instead of continuing to the next entry
(the sibling branches at 607-616 all use `continue`/`close`+fallthrough).
Result: after any malformed (empty devicename/label) entry, later drives'
config replicas are not written for that save; with a persistent malformed
entry at a low index (referenced-only drives created by `sd … drive <name>`
config lines), tail drives' replicas can stay stale across many saves,
defeating the dual-replica design and confusing the
"newest label wins" logic of the next `vinum_scandisk`/`read` (drivecmp sorts
by `label.last_update`, vinumio.c:841-856). Low severity: root-configured
state only, no memory-safety impact.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)