{
 "finding_id": "DF-4630",
 "poc_id": "DF-4630",
 "status": "untested",
 "reproduced": 0,
 "impact": "Storage DoS: each RAID_ACTION on the surviving controller leaks one of 512 request slots until ENOMEM takes down all mpt I/O including disk traffic",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "File-static user_handler_id over a function-deduped GLOBAL handler table: first detach unregisters the handler still used by the survivor - its replies route to the default handler, requests never complete and leak. Refcount-the-registration fix. Cross-file note: mpt_wait_req can TIMEDOUT-mark an already-completed request (permanent leak class).",
 "kernel_refs": [
  "sys/dev/disk/mpt/mpt_user.c:90",
  "sys/dev/disk/mpt/mpt_user.c:157",
  "sys/dev/disk/mpt/mpt_user.c:549",
  "sys/dev/disk/mpt/mpt_user.c:555"
 ],
 "verdict": "not_run: no mpt HBA on guest; 2-controller precondition; code path certain",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: hardware-gated (no Intel DSI panel / no mpt HBA on guest)",
 "fix_evidence": "fix in finding markdown"
}