{
  "finding_id": "DF-4615",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ips_copperhead_reinit ignores the return of ips_copperhead_queue_init (ips.c:730). On a queue-map failure the inits exit path bus_dmamem_free/bus_dma_tag_destroys the status queue (ips.c:672-674) but leaves sc->copper_queue dangling, and reinit reports success; the next COPPER_SCE_BIT interrupt runs ips_copperhead_cmd_status (ips.c:751-757) which increments nextstatus on freed memory (UAF write), reads status[statnum] from freed memory (UAF read), and feeds sc->copper_queue->base_phys_addr from freed memory into a hardware register write. Additionally every successful forced reinit allocates a fresh queue (ips.c:650) without freeing the previous one - one DMA tag + ~528-byte mapped block leaked per watchdog reset; and a tag-create failure takes the exit path with NULL handles (bus_dmamem_free(NULL,NULL,NULL) NULL deref). Not reproduced on the audit guest: no copperhead ServeRAID PCI device exists there (env.txt) and QEMU has no device model. Static trace complete; low severity because the trigger is resource failure on failing hardware with no unprivileged reachability.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (five-step trace: ips.c:629-676 alloc/free-without-NULL, ips.c:730 ignored return, ips.c:745-760 interrupt-context UAF read+write, ips.c:650 leak-per-reinit, ips.c:672-674 NULL-handle variant); env.txt (device absent)",
  "kernel_refs": [
    "sys/dev/raid/ips/ips.c:630",
    "sys/dev/raid/ips/ips.c:650",
    "sys/dev/raid/ips/ips.c:662",
    "sys/dev/raid/ips/ips.c:672",
    "sys/dev/raid/ips/ips.c:730",
    "sys/dev/raid/ips/ips.c:745",
    "sys/dev/raid/ips/ips.c:751",
    "sys/dev/raid/ips/ips.c:755"
  ],
  "poc_changes": "none - no PoC possible without copperhead hardware (QEMU has no ServeRAID device model); static trace only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Same-family note: DF-1758 already covers card-controlled command_id indexing OOB on this hardware; DF-4615 is distinct (driver-side dangling pointer from an ignored error, not card-controlled indexing) and fires on merely failing (non-malicious) hardware.",
  "recommended_fix": "Check ips_copperhead_queue_inits return in ips_copperhead_reinit, NULL sc->copper_queue after freeing, and free the previous queue mapping before allocating a new one on reinit.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No copperhead hardware or device model on the guest, so no A/B kernel run is possible. fix.diff eliminates the dangling pointer by construction (NULL after free + checked return + free-before-realloc).",
  "fix_evidence": "fix.diff (ips.c: exit path NULLs sc->copper_queue; queue_free helper called before re-alloc; reinit checks the init result and fails)."
}