{
  "finding_id": "DF-4718",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "aac_cam_fix_inquiry (aac_cam.c:551-573) dereferences ccb->csio.data_ptr for successful INQUIRY completions without checking that the CCB carried a data buffer; a pass-through INQUIRY with CAM_DIR_NONE (data_ptr NULL) that the adapter completes successfully NULL-derefs in kernel mode -> panic (local DoS, same trigger class as DF-1822). Runtime verification impossible on this guest (no AAC emulation in QEMU); trace is unambiguous. fix.diff adds the buffer guard.",
  "exploit_chain": "root (pass device 0600): camcontrol passthrough INQUIRY with no data buffer on an AAC bus -> adapter returns SUCCESS -> fix_inquiry reads *(NULL) -> kernel panic",
  "evidence": "code trace: aac_cam.c:543-549 (CDB match), :551-573 (unguarded data_ptr read+write), :626 (called for every XPT_SCSI_IO completion)",
  "kernel_refs": [
    "sys/dev/raid/aac/aac_cam.c:551",
    "sys/dev/raid/aac/aac_cam.c:573",
    "sys/dev/raid/aac/aac_cam.c:626"
  ],
  "poc_changes": "n/a (no seeded PoC)",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "hw-gated (Adaptec PCI adapter required; QEMU has no AAC emulation). Would be Low-impact local DoS on real hardware; filed consistent with DF-1822s severity for the same surface.",
  "recommended_fix": "guard: status==CAM_REQ_CMP && data_ptr != NULL && dxfer_len >= 1 before touching the inquiry data (fix.diff)"
}