{
  "finding_id": "DF-4982",
  "verdict": "untested",
  "impact": "leak (gated: iir HBA + 0600 root-only /dev/iir)",
  "reproduce": {
    "build": "cc -O2 -Wall -o df4982_iir_evt_oracle df4982_iir_evt_oracle.c",
    "run": "./df4982_iir_evt_oracle /dev/iir0",
    "expected": "in-bounds probes: MERGE / APPEND deterministically; raced size=0xFFFF probe drives memcmp past the 16-byte eu union (merge-vs-append = 1-bit kernel-memory equality oracle)"
  },
  "kernel_refs": [
    "sys/dev/raid/iir/iir_ctrl.c:319-347",
    "sys/dev/raid/iir/iir.c:1866-1908",
    "sys/dev/raid/iir/iir.c:145",
    "sys/dev/raid/iir/iir.h:515-565"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "df4982_iir_evt_oracle.c",
    "build.sh",
    "run.sh",
    "env.txt",
    "verdict.json",
    "fix.diff",
    "manifest.json"
  ]
}