{
  "finding_id": "DF-5027",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-verified, deterministic crash-dump integrity defect; runtime reproduction impossible on this guest (needs an IBM ServeRAID copperhead adapter AND a crash dump; env.txt shows no IPS hardware). ips_get_free_cmd hands out commands with status bzerod (ips.c:232); on copperhead adapters ips_poll_cmd is an unimplemented stub that only kprintfs (ips.c:810-814), so after ipsd_dump_map_sg issues each dump chunk (ips_disk.c:321-322) no completion is ever delivered -- ipsd_dump_block_complete never runs and the data map is never unloaded -- yet the dump loops only post-issue check, COMMAND_ERROR(&command->status) (ips_disk.c:261-264), tests the still-zeroed status and always passes: every 64K chunk reports success. A copperhead crash dump can therefore be empty or corrupt (chunks issued back-to-back into a command slot the adapter may still own, plus re-loading an already-loaded bus_dmamap at ips_disk.c:256-257, undefined per bus_dma(9)) while savecore believes it valid. Sibling of DF-4616 (morpheus poll window 10x too short -- timing bug in ips.c); this is a different mechanism (complete no-op stub) rooted in ips_disk.cs missing completion check. fix.diff (completed-flag handshake: ipsd_dump_block_complete sets command->completed=1, the loop requires it and resets per iteration) compiled clean in the patched ips.ko build (-Werror).",
  "exploit_chain": "",
  "evidence": "env.txt (hardware-absence probe: no IPS PCI devices, no /dev/ips*, no ipsd disks); VERDICT.md trace: ips.c:232 bzero + ips.c:810-814 stub + ips_disk.c:261-264 zeroed-status check + ips_disk.c:326-336 callback that never runs",
  "kernel_refs": [
    "sys/dev/raid/ips/ips_disk.c:249",
    "sys/dev/raid/ips/ips_disk.c:256",
    "sys/dev/raid/ips/ips_disk.c:261",
    "sys/dev/raid/ips/ips_disk.c:321",
    "sys/dev/raid/ips/ips_disk.c:326",
    "sys/dev/raid/ips/ips.c:232",
    "sys/dev/raid/ips/ips.c:810"
  ],
  "poc_changes": "no runtime PoC possible; hardware-absence probe captured as env.txt evidence",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated); fix compile: patched ips module make -Werror on guest /usr/src copy",
  "run_cmd": "probe: pciconf -l | grep -E 1014|9005 ; ls /dev/ips* (env.txt)",
  "code_hash": "",
  "notes": "Confidence certain refers to the code chain (unconditional control flow, no timing); status not_reproduced refers to runtime exercise, which is hardware-gated. Low severity: dump-path-only, hardware-gated, but silent integrity loss of crash dumps (forensics value). Distinct from DF-4616 (morpheus timing) -- different adapter, different file, different failure mode (false success vs short wait).",
  "recommended_fix": "ipsd_dump_block_complete: set command->completed = 1; ipsd_dump loop: require completed != 0 (else EIO + break) and reset the flag per iteration, so a poll that never delivers (copperhead stub) fails the dump loudly instead of reporting fake success (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff compile-validated as part of the merged patched ips.ko module build on the guest (-Werror clean, fix_validation.log in DF-5026s pack; sources restored). Behavioral validation is hardware-gated (no copperhead adapter, and exercising it needs a crash dump), so the fix cannot be exercised end-to-end.",
  "fix_evidence": "fix.diff; patched ips.ko build log (fix_validation.log, referenced from DF-5026 pack); VERDICT.md fix section"
}