{
  "finding_id": "DF-5046",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Genuine DF-5025/DF-5013-family detach UAF: idad_detach (ida_disk.c:302-311) frees the softc with no open-count gate and no in-flight drain; disk_destroys sync wait covers only disk-enumeration refs (subr_disk.c:540-548), cdev teardown is async and keeps the cdev alive under open fds with si_ops=id_ops and si_drv1 dangling, and no cdev path drains si_track (bio_track_wait is vnode-only). Post-detach read/write via a still-open fd or a late idad_intr writes into freed memory (devstat_start_transaction ida_disk.c:174, ida_submit_buf ida_disk.c:175, devstat_end_transaction_buf ida_disk.c:224). Untested solely because the guest has no Compaq SMART/IDA hardware (pciconf: no 0x0e11 device, no /dev/idad*) \u2014 the code trace is line-accurate and the driver is compiled into X86_64_GENERIC. Severity Low: trigger requires root (kldunload); unlike mfi there is no unprivileged runtime delete path.",
  "exploit_chain": "root (kldunload ida) -> idad_detach frees softc under open fd -> open fd read/write -> idad_strategy -> idad_getsoftc returns dangling si_drv1 -> devstat/queue writes into freed idad_softc+ida_softc. Not an escalation primitive (root already held); heap grooming around the freed softc would give kernel memory corruption on hardware.",
  "evidence": "env.txt (live guest: no 0x0e11 PCI function, NO_IDAD_DEVS, driver present in kldstat); VERDICT.md full trace with path:line for every hop; fix.diff (git apply --check clean)",
  "kernel_refs": [
    "sys/dev/raid/ida/ida_disk.c:302-311",
    "sys/dev/raid/ida/ida_disk.c:94-99",
    "sys/dev/raid/ida/ida_disk.c:145-189",
    "sys/dev/raid/ida/ida_disk.c:213-226",
    "sys/kern/subr_disk.c:876-880",
    "sys/kern/subr_disk.c:527-556",
    "sys/vfs/devfs/devfs_core.c:759-763",
    "sys/vfs/devfs/devfs_core.c:1440-1459",
    "sys/kern/kern_device.c:355-389",
    "sys/kern/vfs_bio.c:565"
  ],
  "poc_changes": "No runnable PoC exists (hardware-gated). Pack contains the hardware-absence evidence and the verified-code trace instead; fix.diff generated against sys/ and validated with git apply --check.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "n/a \u2014 hardware-gated, no PoC build possible",
  "run_cmd": "vm.sh run_root pciconf -l | grep -i 0e11; ls /dev/idad* (result: absent/empty \u2014 driver cannot attach)",
  "code_hash": "bc58832643f641e76151a21c6e335107c49a51a9897b41742c06f577b504b93d (sha256 of fix.diff; no PoC source exists)",
  "notes": "Family: DF-5013 (mfi, High \u2014 had unprivileged AEN delete path) / DF-5025 (ips, Low \u2014 root-only detach). IDA has zero ioctls and no runtime delete, so root-only => Low. Co-dependent with DF-1915 (controller-side ida_detach frees under in-flight I/O); this pack covers the idad side. Guest left clean (read-only probes only).",
  "recommended_fix": "Gate idad_detach on an open counter maintained in idad_open/idad_close (return EBUSY while open), and drain in-flight bios before freeing (controller side per DF-1915).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds opencount to struct idad_softc, increments/decrements in idad_open/idad_close, and returns EBUSY from idad_detach while any fd is open \u2014 closes the open-fd UAF leg; the in-flight leg additionally needs DF-1915s controller quiesce. Cannot be build/boot validated: no IDA hardware on the guest. Diff is git-apply-clean against sys/.",
  "fix_evidence": "fix.diff (git apply --check: APPLIES_CLEAN); context hunks at ida_disk.c idad_open/idad_close/idad_detach and idavar.h struct idad_softc"
}