{
  "finding_id": "DF-4969",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Runtime untestable on this guest: the adw driver is compiled into the default kernel (sys/config/X86_64_GENERIC:101 device adw) but no PCI device with AdvanSys vendor 0x10CD exists (pciconf -l, env.txt), so adw_pci_probe never matches and adw_pci_attach never runs. Defect certain by inspection and confirmed against the guests verbatim /usr/src source by adw_static_check.sh: adw_pci_attach allocates an active BAR resource at adw_pci.c:211-225 and an IRQ resource at :291-298, but every error path calls only adw_free(adw) (which unwinds the DMA hierarchy and kfrees the softc but never calls bus_release_resource and never tears down the interrupt - adwcam.c:844-886), and the entry->setup() failure path at adw_pci.c:242-245 returns without even adw_free, leaking the softc as well. With AdvanSys hardware present, any attach failure (bad signature, chip-wedge ENXIO from adw_init_chip, tag/IRQ alloc failure, bus_setup_intr failure) permanently leaks the cards register resource (and IRQ once reached); repeat probes stack leaks. No UAF is reachable today: the post-bus_setup_intr steps cannot fail (cam_sim_alloc is M_INTWAIT, xpt_bus_register returns CAM_SUCCESS unconditionally), so the handler is never left hooked into freed memory. Distinct from DF-4309 (per-ACB dma-map leak): this is the bus-resource side.",
  "exploit_chain": "",
  "evidence": "run.log (adw_static_check.sh output from the guests /usr/src showing the exact cited lines); VERDICT.md (path-by-path trace); env.txt (no 0x10CD PCI device, device adw at X86_64_GENERIC:101)",
  "kernel_refs": [
    "sys/dev/disk/advansys/adw_pci.c:211",
    "sys/dev/disk/advansys/adw_pci.c:242",
    "sys/dev/disk/advansys/adw_pci.c:265",
    "sys/dev/disk/advansys/adw_pci.c:274",
    "sys/dev/disk/advansys/adw_pci.c:293",
    "sys/dev/disk/advansys/adw_pci.c:300",
    "sys/dev/disk/advansys/adwcam.c:844"
  ],
  "poc_changes": "no runtime trigger possible (hardware absent); wrote a static line-trace reproducer runnable on any DF guest with /usr/src",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "n/a - static trace (sh adw_static_check.sh), no kernel PoC possible without AdvanSys PCI hardware",
  "run_cmd": "sh adw_static_check.sh /usr/src/sys/dev/disk/advansys",
  "code_hash": "cb17408f0b504c3f43b69e31e22f728f94d539c3fa033fd99250e530e3a15f90",
  "notes": "Killed candidates while here: the init_level++ placement before the tag-error check is benign (bus_dma_tag_destroy(NULL) is NULL-safe, busdma_machdep.c:334); the setup-intr-then-fail UAF is unreachable (cam_sim_alloc M_INTWAIT, xpt_bus_register cannot fail); no detach method exists but module unload with live devices is refused EBUSY, so no unload UAF.",
  "recommended_fix": "Release regs (and irq once allocated) on every adw_pci_attach error path and add the missing adw_free() on the entry->setup() failure path.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not testable: no AdvanSys hardware on this guest, baseline and patched attach paths cannot be exercised. fix.diff adds the missing bus_release_resource/adw_free unwinds.",
  "fix_evidence": "fix.diff; hardware absence documented in env.txt"
}