{
  "finding_id": "DF-4834",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O2 -Wall -o df4834 df4834_harness.c -lpthread",
    "run": "./df4834",
    "expected": "arm1: SIGSEGV at guard page (OOB write past 16-entry arrays), canary slots 16..591 hit; arm2: copyout(ioctl_data_mem[16..23]=kernel-stack-values,...); arm3 fixed model: clean, no OOB writes"
  },
  "kernel_refs": [
    "sys/dev/raid/mrsas/mrsas.c:1151",
    "sys/dev/raid/mrsas/mrsas_ioctl.c:150",
    "sys/dev/raid/mrsas/mrsas_ioctl.c:153",
    "sys/dev/raid/mrsas/mrsas_ioctl.c:186",
    "sys/dev/raid/mrsas/mrsas_ioctl.c:225",
    "sys/dev/raid/mrsas/mrsas_ioctl.c:307",
    "sys/dev/raid/mrsas/mrsas_ioctl.c:354",
    "sys/dev/raid/mrsas/mrsas.c:790"
  ],
  "artifacts": ["README.md", "VERDICT.md", "df4834_harness.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}