{
  "finding_id": "DF-4640",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The timeout unwinds of the attach-time info commands free the hardware-owned commands resources: ips_send_adapter_info_cmd (ips_commands.c:317-331) and ips_send_drive_info_cmd (:414-432) tsleep for a fixed 30 s / 10 s; on ETIMEDOUT they bus_dmamap_unload + bus_dmamem_free + bus_dma_tag_destroy the info buffer and clear IPS_STATIC_BUSY (ips_insert_free_cmd, :331/:432) while the adapter still holds the command. A late adapter completion then (a) DMA-writes IPS_ADAPTER_INFO_LEN / IPS_DRIVE_INFO_LEN bytes into the freed kernel heap allocation (device-side UAF write) and (b) runs commandarray[0]->callback via ips_morpheus_check_intr (ips.c:567-576) / ips_copperhead_intr on a slot that ips_get_free_cmd (ips.c:232) has zeroed - NULL indirect call panic window - or falsely completes the slots new owner (early ips_timed_wait return, memcpy of stale data into sc->adapter_info at :322). Trigger is a slow-but-alive ServeRAID adapter at attach, i.e. failing hardware, hence Low severity; the code path itself is unconditional once the timeout fires. Not reproduced: the audit guest has no ServeRAID PCI device and QEMU has no ips device model (env.txt), so the path cannot be instantiated; the line-accurate trace in VERDICT.md/timeout_uaf_path.c is the evidence. Distinct from DF-4614 (ips_cmdqueue_free teardown frees under live commands at ips.c:116-143) - this is the per-command timeout unwind at ips_commands.c:325-331/426-432. Sibling wait-family defect folded in: all other static commands use ips_timed_wait(...,0) = infinite tsleep (ips_commands.c:471,558,673,722,743), so a card wedging mid-attach hangs boot forever instead.",
  "exploit_chain": "requires hostile/flaky hardware: attach -> adapter exceeds 30 s -> freed buffer + recycled slot -> late completion -> device DMA write into freed heap / NULL callback call / false completion of the slots new command",
  "evidence": "VERDICT.md (5-step trace with path:line), timeout_uaf_path.c (annotated path), env.txt (no ServeRAID hardware on guest)",
  "kernel_refs": [
    "sys/dev/raid/ips/ips_commands.c:313",
    "sys/dev/raid/ips/ips_commands.c:317",
    "sys/dev/raid/ips/ips_commands.c:325",
    "sys/dev/raid/ips/ips_commands.c:328",
    "sys/dev/raid/ips/ips_commands.c:331",
    "sys/dev/raid/ips/ips_commands.c:415",
    "sys/dev/raid/ips/ips_commands.c:426",
    "sys/dev/raid/ips/ips_commands.c:432",
    "sys/dev/raid/ips/ips.c:232",
    "sys/dev/raid/ips/ips.c:567",
    "sys/dev/raid/ips/ips.c:573"
  ],
  "poc_changes": "n/a - no PoC possible without ServeRAID hardware (same constraint as DF-4613/4615); pack documents the static trace and the hardware absence",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "ips.c reviewers cross-file lead #2 (bus_dmamap_load return unchecked at ips_commands.c:231) was investigated alongside this finding and is a FALSE POSITIVE on DragonFly: bus_dmamap_load (sys/platform/pc64/x86_64/busdma_machdep.c:804) ALWAYS invokes the callback with the error status on the synchronous path, and the EINPROGRESS path queues the map and invokes the stored callback on deferred completion (:645-657, :1416); ips_io_request_callbacks error path (ips_commands.c:116-124) therefore unloads, errors the bio and recycles the command slot on EFBIG - no leak. No finding filed for it.",
  "recommended_fix": "On ETIMEDOUT in ips_send_adapter_info_cmd/ips_send_drive_info_cmd, do not unload/free/recycle: keep IPS_STATIC_BUSY set and the DMA allocation until the adapter is reset or attach aborts with the card quiesced; give the infinite ips_timed_wait(...,0) waits finite budgets.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No A/B possible: the trigger needs real ServeRAID hardware that stalls >30 s at attach; the guest has none (env.txt) and QEMU has no ips device model.",
  "fix_evidence": "env.txt (0 ServeRAID PCI devices, /dev/ips* absent)"
}