{
 "finding_id": "DF-4721",
 "title": "launch_requests() iterates freed request group after inline completion (trailing XFR_BAD_SUBDISK) - kernel panic on ordinary degraded RAID-5 writes",
 "verdict": "reproduced",
 "impact": "panic (kernel UAF)",
 "reproduce": {
  "build": "guest: cc -o trigger trigger.c",
  "run": "sh ../DF-4714/setup_vinum.sh && vinum setstate -f down rv.p0.s2 && ./trigger",
  "expected": "Fatal trap 12 at launch_requests+0xc2 within milliseconds (baseline); write OK + readback match (patched)"
 },
 "kernel_refs": [
  "sys/dev/raid/vinum/vinumrequest.c:399",
  "sys/dev/raid/vinum/vinumrequest.c:408"
 ],
 "artifacts": [
  "README.md",
  "trigger.c",
  "fix.diff",
  "panic.txt",
  "run.patched.log",
  "verdict.json",
  "manifest.json"
 ]
}