{
  "finding_id": "DF-4716",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "wrong-operand condition (m.flags instead of rqe->flags) makes the not the bad subdisk guard at vinumraid5.c:536-538 always true; dead-effect today because XFR_BAD_SUBDISK rqes are never launched, but it is the exact kind of stale guard that hides launch-path lifetime bugs (cf. DF-4721). Info-level hardening; fix.diff corrects the operand. Not PoC-verified: no runtime-observable effect.",
  "exploit_chain": "",
  "evidence": "source trace only: request.h:48 (XFR_BAD_SUBDISK set only via rqe->flags at vinumraid5.c:523), vinumrequest.c:410 (launch skip)",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumraid5.c:536"
  ],
  "poc_changes": "n/a (no seeded PoC; static finding)",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info severity, skipped runtime verification per audit policy (no observable behavior)",
  "recommended_fix": "test rqe->flags instead of m.flags (fix.diff)"
}