{
  "finding_id": "DF-4897",
  "status": "untested",
  "reproduced": 0,
  "impact": "persistent silent on-disk RAID-4/5 parity corruption from a single failed component read: complete_raid5_write() XORs undefined (non-zeroed malloc) buffer contents of failed reads into the parity block and writes it to stable storage; the corruption survives daemon retries (retry XORs against the poisoned parity) and later surfaces as corrupt reconstructed data with no error indication",
  "confidence": "certain",
  "verdict": "Inspection-certain integrity defect, not runnable on this guest: the gate at vinuminterrupt.c:194-196 never tests B_ERROR and complete_raid5_write() has no error handling; failed first-phase reads leave XFR_MALLOCED buffers with stale kernel-heap contents (Malloc at vinumrequest.c:834 is not zeroed) which are XORed into parity (:331-348 degraded, :362-385 normal) and committed by the unconditional parity write (:433-464). Same facility gap as DF-4481/DF-4896: this guests md-backed drives cannot be made to fail I/O (re-verified 2026-09-24). Proposed guard (skip complete_raid5_write when the completing bp has B_ERROR; full fix should veto the parity update if ANY member read failed) in README.md; not validatable without error injection.",
  "exploit_chain": "",
  "evidence": "README.md (line-cited dataflow incl. why the corruption persists through retries: parity=poisoned^old^new)",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinuminterrupt.c:194",
    "sys/dev/raid/vinum/vinuminterrupt.c:331",
    "sys/dev/raid/vinum/vinuminterrupt.c:362",
    "sys/dev/raid/vinum/vinuminterrupt.c:433",
    "sys/dev/raid/vinum/vinumrequest.c:834"
  ],
  "poc_changes": "no seed; trigger requires one failed component read (failing device)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (no runnable PoC on this guest)",
  "run_cmd": "n/a (requires component I/O-error injection; md devices on this image cannot fail \u2014 verified)",
  "code_hash": null,
  "notes": "Severity Low (needs a genuine component read failure; impact is worst-case RAID integrity \u2014 silent persistent corruption).",
  "recommended_fix": "Do not run the parity update from failed components: add && ((bp->b_flags & B_ERROR) == 0) to the :194 gate and veto on any member B_ERROR; diff in README.md.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: no failure-injection facility on the guest to stage a failed component read",
  "fix_evidence": "README.md proposed diff"
}