{
  "finding_id": "DF-4715",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "bre5()s refusal-path loop (vinumraid5.c:413-417) marks plex->sdnos[0..m.sdcount-1] stale - indexing by COUNT instead of the participating ordinals. Guest-verified: with the write spanning data ordinals 1,2 (both down), the healthy parity subdisk s0 (ordinal 0) was force-marked sd_stale and the transition persisted; involved (already down) sds untouched. Patched kernel (ordinal walk in DF-4714 fix.diff): same EIO, s0 stays up.",
  "exploit_chain": "root: RAID-5 array with two data subdisks of one stripe down (drive faults); any write spanning both -> healthy parity subdisk wrongly invalidated (saved to config) -> array degraded beyond the actual fault",
  "evidence": "DF-4714/run.log step [2] (baseline: s0 up->stale), run.patched.log / patched.step2.txt (fixed: s0 stays up)",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumraid5.c:413"
  ],
  "poc_changes": "reuses DF-4714s setup and single-32KB-write trigger methodology",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT (baseline #0 Thu Jul 2 / patched #1 Wed Sep 23 01:37:18 UTC 2026) x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "see DF-4714 pack",
  "run_cmd": "sh ../DF-4714/setup_vinum.sh && sh run.sh",
  "code_hash": "df4715-shares-df4714-trigger-see-df4714-pack",
  "notes": "in-bounds array access (sdcount <= subdisks-1), pure wrong-operand logic bug; verified within the DF-4714 verification session",
  "recommended_fix": "walk the participating ordinals (firstsdno, parity-skip, wrap) instead of [0..sdcount) - included and validated in findings/poc/DF-4714/fix.diff",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "patched kernel: EIO preserved (correct refusal) and s0 no longer staled - run.patched.log step 2",
  "fix_evidence": "patched.step2.txt"
}