{
  "finding_id": "DF-4720",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "XPT_ABORT/XPT_TERM_IO are stubs (aac_cam.c:681-691) and aac_timeout (aac.c:2323) only logs, so a stalled adapter leaks one FIB per timed-out command until the pool is exhausted and all controller I/O wedges (same terminal state as DF-3819, reached from ordinary disk I/O). Certain from trace; hw-gated so not runtime-verified. No one-line fix; needs firmware abort integration.",
  "exploit_chain": "stalled/faulty target behind AAC -> command timeouts -> abort/reset escalations are no-ops -> FIB pool exhaustion -> controller I/O wedge (system DoS until reboot)",
  "evidence": "code trace: aac_cam.c:681-691 (stubs), aac.c:2323-2350 (log-only timeout), aac_cam.c:526-533 (empty poll)",
  "kernel_refs": [
    "sys/dev/raid/aac/aac_cam.c:682",
    "sys/dev/raid/aac/aac_cam.c:688",
    "sys/dev/raid/aac/aac_cam.c:527",
    "sys/dev/raid/aac/aac.c:2323"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "hw-gated. Robustness/lifetime gap rather than memory corruption; impact ceiling is controller-wide I/O hang.",
  "recommended_fix": "implement command cancellation for the CAM path: send the adapters abort FIB (or at minimum complete timed-out ccbs with CAM_CMD_TIMEOUT and take the adapter offline after draining), and make XPT_ABORT release the associated aac_command"
}