{
  "finding_id": "DF-4851",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Operational misconfiguration only (no memory-safety impact): aacs MSI tunable is registered under mfi(4)s exact name (hw.mfi.msi.enable, copy-pasted from mfi_pci.c:107-108) - the natural hw.aac.msi.enable knob does not exist, boot-time settings intended for mfi silently apply to every aac adapter, and the NOMSI attach path permanently writes aac_msi_enable=0 so later MSI-capable aac cards are forced to INTx. Upstream FreeBSD uses a per-driver name. No aac hardware on the guest. Rename-the-tunable + per-device-decision fix.",
  "exploit_chain": "set hw.mfi.msi.enable=0 for an mfi issue -> every aac card also INTx; or NOMSI 2230S attaches before a 5405 -> 5405 gets INTx despite default=1",
  "evidence": "findings/poc/DF-4851/ (this verdict)",
  "kernel_refs": [
    "sys/dev/raid/aac/aac_pci.c:61",
    "sys/dev/raid/aac/aac_pci.c:425-428",
    "sys/dev/raid/mfi/mfi_pci.c:107-108"
  ],
  "guest_uname": "",
  "code_hash": ""
}