# VERDICT — DF-4707

**status: inconclusive (hardware-gated) · reproduced: 0 · analysis
confidence: likely**

## Was it reproduced?
No — the audit guest has no MegaRAID controller and no `/dev/amr*`
(verified this run), so the guard sequence cannot be exercised.
`kldload amr` finds no device. The defeat is, however, certain from
inspection:

- `amr_open` (amr.c:422-431): `sc->amr_state |= AMR_STATE_OPEN;` —
  bit set per open, no exclusivity, no counting.
- `amr_close` (amr.c:438-447): `sc->amr_state &= ~AMR_STATE_OPEN;` —
  bit cleared on **any** close, so with 2 open descriptors, 1 close
  makes `amr_pci_detach`'s guard (amr_pci.c:365-366) pass while a
  descriptor is live.
- `amr_pci_free` then runs `destroy_dev` + full DMA/softc teardown
  (amr_pci.c:371→477-527) while the survivor's cdev back-pointer
  `si_drv1` (set at amr.c:263, consumed at amr.c:707 in every
  management ioctl) still references the softc → use-after-free /
  stale-devclass NULL deref on the next ioctl.
- TOCTOU: an `amr_open` racing past the detach check sets the bit on a
  sc mid-teardown (no lock/freeze anywhere on this path).

## Why Low
The unload requires privilege; the primary victim is an
operator-group user's management fd. The bug is a refcount/lifetime
error with memory-safety fallout, not a self-service privesc.

## Fix validation
Not possible on this guest (no amr hardware). `fix_status:
not_testable`. The proposed counter is the standard DF driver pattern
(see e.g. other cdevsw drivers that track opens).

## Guest state
Guest untouched; stayed up.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.