{
  "finding_id": "DF-4955",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "leak",
  "confidence": "likely",
  "verdict": "Hardware-gated (wedged LSI SAS3 card at attach): mpr_free can early-return (subsystem-detach or transition_ready failure on the same dead card) WITHOUT running mpr_iocfacts_free, while mpr_pci_free unconditionally destroys the parent DMA tag - DFly bus_dma_tag_destroy has no child-reference check (kfree unconditionally, unlike FreeBSDs refcounted EBUSY), so the parent is freed and the 7 child tags + all their IOC-facts DMA memory leak forever holding a dangling parent. ~hundreds of KB per failed attach, amplifiable via devctl retry. Permanent leak only (callouts drained first - no UAF). Route-early-returns-through-iocfacts_free fix (or harden bus_dma_tagDestroy).",
  "exploit_chain": "wedged IOC -> transition failures -> mpr_free early return skips iocfacts_free -> parent tag destroyed under live children -> children+DMA leak permanently",
  "evidence": "findings/poc/DF-4955/ (this verdict; code-trace proof)",
  "kernel_refs": [
    "sys/dev/raid/mpr/mpr.c:2125-2137",
    "sys/dev/raid/mpr/mpr_pci.c:355-357",
    "sys/platform/pc64/x86_64/busdma_machdep.c:334-345"
  ],
  "guest_uname": "",
  "code_hash": ""
}