# VERDICT — DF-4708

**status: inconclusive (hardware-gated; Info hardening) · reproduced:
0 · analysis confidence: likely (leak) / speculative (load-failure
branches)**

## Was it reproduced?
No — attach-time code behind amr probe; the audit guest has no
MegaRAID controller (verified: no matching PCI device, `/dev/amr*`
absent). Static analysis:

- Leak (certain once triggered): every `goto retry` iteration
  (amr_pci.c:600-603) drops the previous `bus_dmamem_alloc` result and
  overwrites `sc->amr_sg_dmamap` without `bus_dmamap_unload` /
  `bus_dmamem_free` — permanent loss of `segsize` bytes + map
  (amrvar.h sizing: `sizeof(amr_sg[64]entry) * AMR_NSEG *
  AMR_MAXCMD`).
- Unbounded loop: if `bus_dmamap_load` (amr_pci.c:599) fails, its
  error is discarded, the helper never sets `amr_sgbusaddr` (softc,
  bzeroed → 0), `0 < 0x2000` holds, and the loop retries forever
  under persistent failure → unbounded leak until kmem exhaustion
  during boot/kldload (DoS).
- `amr_setup_mbox` (amr_pci.c:654-660): unchecked load; on failure the
  **uninitialized stack** `baddr` becomes `sc->amr_mailboxphys` — the
  physical address later given to the controller for completion DMA.
  Practically unreachable (1-segment load of just-allocated,
  constraint-matched memory) → speculative, but the fix is one line.
- `amr_ccb_map` (amr_pci.c:698-699): same unchecked load for
  `sc->amr_ccb_busaddr`.

## Fix validation
Not possible on this guest. `fix_status: not_testable`.

## Guest state
Guest untouched; stayed up.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.