{"finding_id":"DF-4894","status":"untested","attempts":0,"reproduced":0,"impact":"dos","confidence":"likely","verdict":"Crash-time hardening (Info; needs non-conforming aac firmware + a panic): aac_disk_dump consumes firmware-derived geometry with no host-side clamping - max_sectors==0 -> maxio=0 -> len=0 -> the dump loop never advances (post-panic hang, dump lost); sg_tablesize > FIB capacity writes nsegs aac_sg_entries past fib->data into the shared sync-fib area; SectorCount is u16 while maxio can reach 64MB (truncates mod 65536); BlockNumber u32 truncates >2TB dumps; the static dump map is shared across controllers. The DF-4797/4874 teardown family is KILLED for this driver (detach refuses while open; no dsgone; no self-free - traced in full). Clamp-at-acquisition + dump-loop guards fix.","exploit_chain":"fw returns 0/oversized GETCOMMPREF -> panic -> dump spins forever or corrupts the sync FIB","evidence":"findings/poc/DF-4894/ (this verdict)","kernel_refs":["sys/dev/raid/aac/aac_disk.c:281","sys/dev/raid/aac/aac_disk.c:314-336","sys/dev/raid/aac/aac.c:1789-1807","sys/dev/raid/aac/aac_disk.c:256-257"],"guest_uname":"","code_hash":""}