# DF-4973 VERDICT

## Finding under test
`sys/dev/disk/dm/dmirror/dm_target_dmirror.c` is non-compiling, unbuildable,
unregistered dead code — hence no attack surface — despite containing latent
memory-safety defects (double `vn_strategy` on one bio at
dm_target_dmirror.c:376-377, post-loop OOB `&config->disks[i]` at :295,
double `biodone` of the parent bio at :135-137/170-175, and `XXX`/`foo`
placeholders at :157, :174-175, :186, :196, :262).

## What was done (guest, DragonFly 6.5-DEVELOPMENT #0, X86_64_GENERIC)
1. Verified the wiring on the source tree:
   * `sys/dev/disk/dm/Makefile` — `SUBDIR= linear striped crypt delay flakey`;
     **dmirror is not in it**;
   * `grep -rn dm_target_dmirror sys/conf/ sys/config/` → **no references**;
   * contrast `sys/dev/disk/dm/linear/dm_target_linear.c` (tail): every live
     target self-registers via `DM_TARGET_MODULE` + `dm_target_insert`;
     dmirror has neither, and no init/strategy-facing table at all
     (`/* XXX: add missing dm functions */`, :384).
2. Ran the authoritative build of the orphan kmod on the guest:
   `cd /usr/src/sys/dev/disk/dm/dmirror && make` → **exit 1**, 216 lines of
   compiler output (`build.log`), including:
   * `error: request for member 'block_offset' in something not a structure or union` (the file's `dm_target_crypt_config_t` confusion),
   * `error: request for member 'pdev' in something not a structure or union` (:376-377),
   * `implicit declaration of function 'dmirror_write'` (:365),
   * plus the undeclared-identifier / placeholder errors (`XXX`, `foo`,
     `nestbuf`, `next_disk`, `SEGNO_FROM_OFFSET` …).
   No `dm_target_dmirror.ko` was produced.
3. Confirmed no prebuilt module exists anywhere on the running system:
   `/boot/kernel/dm_target_dmirror*` and `/boot/modules/dm_target_dmirror*`
   → `No such file or directory` (`env.txt`).

## Result: claim CONFIRMED (evidence-pack status `build_failed` = the demonstration)
The module cannot be compiled, is not part of any kernel/module build, is not
shipped prebuilt, and registers no dm target even in intent. There is no
reachable code path from `dmsetup`/devfs/ioctl to any function in this file.
All latent bugs in it are inert.

Impact: none (informational). The security-relevant statement is the negative
one: **the last un-audited dm target contributes zero attack surface**.

## Why no fix validation was run
The recommended fix is deletion of a directory that no build references;
there is no kernel to rebuild or PoC behavior to re-test (nothing changes in
any produced binary). fix_status = not_testable for that reason.

## Environment
`env.txt`: DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026,
cc 8.3 [DragonFly], kern.osreldate 600519, hw.ncpu 6.
Guest left clean (only /tmp/dmirror_build.log + a failed module obj dir in
/usr/src, which was never installed; guest not dirtied otherwise).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)