{
  "finding_id": "DF-4790",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent, currently-dead defects in mpr_table.c: (1) mpr_print_evt_sas walks data->PHY[i] for firmware-supplied NumEntries with no EventDataLength bound (mpr_table.c:412-425) \u2014 the same class as live pass-1 findings DF-1474/DF-3919/DF-4560, but this function has zero callers tree-wide; (2) mpr_describe_table returns table[i+1].string, one entry past the {NULL,0} sentinel (mpr_table.c:72) \u2014 in-bounds today only because all 13 tables ship an extra Unknown entry. No reachable path, nothing to execute; filed as Info so the patterns are not resurrected as-is.",
  "exploit_chain": "",
  "evidence": "README.md (liveness + line cites), VERDICT.md (grep evidence of dead callers), fix.diff (NumEntries bound)",
  "kernel_refs": [
    "sys/dev/raid/mpr/mpr_table.c:63",
    "sys/dev/raid/mpr/mpr_table.c:72",
    "sys/dev/raid/mpr/mpr_table.c:412",
    "sys/dev/raid/mpr/mpr_table.c:457",
    "sys/dev/raid/mpr/mpr_sas_lsi.c:967"
  ],
  "poc_changes": "no PoC produced \u2014 dead code, no trigger path exists",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Preferred fix is deletion of the dead printers; fix.diff shows the minimal bound if the code is kept. Missing break at mpr_table.c:457 is benign (falls into default: break).",
  "recommended_fix": "Delete the dead mpr_print_* debug printers or bound NumEntries by EventDataLength; use a literal fallback in mpr_describe_table",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "dead code \u2014 nothing to validate on the guest; the diff is a defensive bound only",
  "fix_evidence": "findings/poc/DF-4790/fix.diff"
}