{
  "finding_id": "DF-4655",
  "poc_id": "DF-4655",
  "status": "untested",
  "reproduced": 0,
  "impact": "Kernel heap leak (sizeof(struct callout) per bus scan, unbounded across controller resets) + wrong-type free corrupting malloc accounting",
  "confidence": "certain",
  "attempts": 0,
  "guest_uname": null,
  "code_hash": null,
  "exploit_chain": [],
  "evidence": "kfree(ccb, M_TEMP) vs xpt_alloc_ccbs M_CAMXPT + separate timeout_ch alloc that xpt_free_ccb frees. Bus scans run at attach and after EVERY controller reset - a flaky controller under the watchdog loop leaks unboundedly. xpt_free_ccb fix.",
  "kernel_refs": [
    "sys/dev/raid/twa/tw_osl_cam.c:578",
    "sys/dev/raid/twa/tw_osl_cam.c:579"
  ],
  "verdict": "not_run: needs 3ware 9xxx hardware (resets trigger rescans); defect certain by inspection vs cam_xpt alloc/free pairing",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: no 3ware hardware on guest",
  "fix_evidence": "fix in finding markdown"
}