{
  "finding_id": "DF-4719",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "aac_cam_detach() frees camsc->sim without cancelling AAC_EVENT_CMFREE events queued by aac_cam_action()s ENOMEM path (aac_cam.c:395-407); aac_cam_event() (aac_cam.c:165-172) later calls xpt_release_simq/xpt_done through the freed sim/softc -> UAF. Requires adapter detach while a ccb waits on the exhausted FIB pool; structural leak of the event is clear from the trace, the exact interleaving is speculative. hw-gated (no AAC emulation) - not runtime-verified. fix.diff cancels pending events at detach.",
  "exploit_chain": "FIB pool exhausted (e.g. hung firmware under I/O) -> ccb frozen on CMFREE event -> device detach frees sim -> next command release fires event -> xpt_release_simq on freed sim (UAF write in CAM)",
  "evidence": "code trace: aac_cam.c:395-407 (event queued with ccb), aac_cam.c:165-172 (event uses camsc->sim), aac_cam.c:191-213 (detach frees sim, never drains aac_ev_cmfree)",
  "kernel_refs": [
    "sys/dev/raid/aac/aac_cam.c:165",
    "sys/dev/raid/aac/aac_cam.c:401",
    "sys/dev/raid/aac/aac_cam.c:206",
    "sys/dev/raid/aac/aac.c:1416"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "hw-gated + root-triggered timing window; speculative per audit rubric. Same lifetime sloppiness family as DF-3822 (aac_detach container list).",
  "recommended_fix": "drain/cancel CMFREE events referencing the sim in aac_cam_detach before cam_sim_free (fix.diff)"
}