{
  "finding_id": "DF-5013",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Hardware-gated: no LSI MegaRAID controller exists on the audit guest, so the mfi attach/lifecycle (LD probe, AEN handling, MFI_CMD LD_DELETE) cannot run and no runtime trigger was possible. The defect is source-proven end-to-end: device_delete_child on an ld child (AEN path mfi.c:1494-1510 with no gate at all; LD_DELETE/CFG_CLEAR post-path mfi.c:2630-2645 with an advisory-only pre-check) frees the mfi_disk softc via device_detach -> device_set_driver(NULL) -> kfree(dev->softc) (subr_bus.c:2127-2130,2146) while (a) bios still in flight are completed later by mfi_disk_complete against the freed softc (write-after-free via devstat_end_transaction_buf, mfi_disk.c:310; read-after-free via sc->ld_disk.d_cdev, mfi_disk.c:314), and (b) a raced-open descriptor keeps si_drv1 pointing into freed memory (devfs unlink is async vs disk_destroy, devfs_core.c:755-763; mfi_disk_detachs EBUSY is conditional on mfi_keep_deleted_volumes||mfi_detaching, both default 0). Impact ceiling: kernel heap UAF reachable by an operator-group user (raw mfid nodes are root:operator 0640; /dev/mfi0 is 0660) racing an open fd/in-flight I/O against a volume-offline event or LD_DELETE - memcorrupt/privesc class, not exercised at runtime here.",
  "exploit_chain": "design only (no hardware): operator holds O_RDONLY fd on /dev/mfidN -> volume goes OFFLINE (drive pull / operator LD_DELETE on a scratch volume via MFI_CMD on /dev/mfi0) -> AEN mfi_decode_evt deletes the child -> softc kfreed -> subsequent pread()/close() on the held fd deref si_drv1 into freed slab (mfi_disk_strategy reads sc->ld_controller and lockmgrs on it) and/or in-flight bio completion writes into the freed softc -> groom the freed softc slab -> forge ld_controller / victim object -> controlled kernel write -> uid=0",
  "evidence": "VERDICT.md full chain with citations; the decisive sites are mfi.c:1508 (ungated device_delete_child), mfi_disk.c:178-185 (conditional-only EBUSY), subr_bus.c:2127-2130 (softc kfree inside delete), mfi_disk.c:304-320 (post-free completion consumers), mfi.c:721-724 (operator-reachable ioctl node)",
  "kernel_refs": [
    "sys/dev/raid/mfi/mfi_disk.c:171",
    "sys/dev/raid/mfi/mfi_disk.c:178",
    "sys/dev/raid/mfi/mfi_disk.c:295",
    "sys/dev/raid/mfi/mfi_disk.c:304",
    "sys/dev/raid/mfi/mfi_disk.c:310",
    "sys/dev/raid/mfi/mfi_disk.c:314",
    "sys/dev/raid/mfi/mfi.c:1458",
    "sys/dev/raid/mfi/mfi.c:1494",
    "sys/dev/raid/mfi/mfi.c:2570",
    "sys/dev/raid/mfi/mfi.c:2623",
    "sys/dev/raid/mfi/mfi.c:2633",
    "sys/dev/raid/mfi/mfi.c:721",
    "sys/kern/subr_bus.c:2127",
    "sys/kern/subr_bus.c:2146",
    "sys/kern/subr_disk.c:876",
    "sys/vfs/devfs/devfs_core.c:755"
  ],
  "poc_changes": "authored from source analysis; no runnable PoC possible on this guest (no mfi hardware), following the DF-2066/DF-3898 house treatment of HW-gated driver findings",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 depth: pass 1 filed nothing on mfi_disk.c; the adjacent DF-3877 covered only the ioctl-path KASSERT variant. This finding is the lifetime/drain defect across all three delete paths (AEN/LD_DELETE/CFG_CLEAR). Guest verified free of mfi hardware (no LSI PCI IDs); QEMU megasas emulation exists upstream but the audit guests device set is fixed by snapshot, so no runtime exercise was attempted.",
  "recommended_fix": "Track in-flight bios per ld (ld_active under mfi_io_lock), fail new bios with ENXIO once DISABLED, drain in mfi_disk_detach before disk_destroy, and gate the AEN offline-deletion path with mfi_disk_disable() (refuse while open) - see fix.diff (mfivar.h + mfi_disk.c + mfi.c).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (git apply --check clean, 3 files) closes all three holes: DISABLED gate in strategy, drain-before-destroy in detach, mfi_disk_disable gate on the AEN path. Single-fix kernel build not meaningful: entry is hardware-gated on this guest (no MegaRAID controller), so neither baseline nor patched kernel can exercise the lifecycle here; fix validated by inspection against the traced lock protocol (mfi_disk_complete runs under mfi_io_lock via mfi_complete).",
  "fix_evidence": "fix.diff; VERDICT.md Fix section"
}