{
  "finding_id": "DF-4989",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated (no 3ware controller on the audit guest; PoC builds clean and exits ENOENT, run.log). The defect is a dead store: tws_user.c:282-294 computes lpkt.time_remaining_msec in both GET_LOCK branches (granted at :288, remaining-time at :290-291) but never copies lpkt back to ubuf->data_buf, and the function returns SUCCESS (:335) \u2014 so the advisory ioctl locks grant/deny state and remaining time can never reach userland and management agents cannot enforce the serialization the lock exists for. FreeBSDs tws_user.c performs the copy-back; this is a port regression. No memory-safety impact; Low.",
  "exploit_chain": "",
  "evidence": "run.log (clean build + ENOENT + pciconf: no LSI device); VERDICT.md (line-by-line trace of the dead store); tws_getlock.c (issues GET_LOCK twice and prints the fields that stay unchanged)",
  "kernel_refs": [
    "sys/dev/raid/tws/tws_user.c:280-294",
    "sys/dev/raid/tws/tws_user.c:335",
    "sys/dev/raid/tws/tws_user.h:52-56"
  ],
  "poc_changes": "n/a (authored fresh); tws_ioctl_with_payload layout mirrored inline",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o tws_getlock tws_getlock.c",
  "run_cmd": "./tws_getlock",
  "code_hash": "d7e049bfcd95d014f121a0c1b4e9534162d773bd97a4b2d62099be7883dcbd0e",
  "notes": "Logic defect; ioctl data buffers are kernel-pre-copied by sys_ioctl (sys_generic.c:668-730) so the missing copy-back is a lost result, not a fault risk.",
  "recommended_fix": "Add memcpy(ubuf->data_buf, &lpkt, sizeof(struct tws_lock_packet)) at the end of the TWS_IOCTL_GET_LOCK case in tws_ioctl_aen",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated; fix.diff restores the missing copy-back, returning the computed lock state to the caller exactly as the FreeBSD original does."
}