{
  "finding_id": "DF-5047",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "DF-5027-family fake-success dump: idad_dump (ida_disk.c:204-207) propagates ida_commands return, but ida_command can only return EAGAIN/ETIMEDOUT \u2014 the controllers HARD_ERROR/CMD_REJECTED status is detected in ida_done (ida.c:515-524) and then discarded for IDA_COMMAND requests (ida.c:526-528 only wakeup(qcb); ida_wait returns 0 at ida.c:466-467; the drivers own XXX should have status returned here? at ida.c:358-359). A controller-rejected crash-dump write therefore reports success and dumpsys prints Dump complete with missing/garbage pages. Untested solely because the guest has no IDA hardware; the dump chunk math itself is safe (si_iosize_max 64KB at ida_disk.c:281 clamps cb_dumpdata chunks, so req.bcount u16 never wraps and dmamap_load stays within the MAXBSIZE tag). Low: panic-time, hardware-failure-gated integrity loss of the crash dump, not memory unsafety; normal user I/O error path (ida.c:530-532) sets B_ERROR correctly.",
  "exploit_chain": "",
  "evidence": "env.txt (no 0x0e11 PCI function, no /dev/idad* dump device configurable); VERDICT.md step-by-step trace incl. dump_machdep.c chunking proof that sizes are safe; fix.diff (git apply --check clean)",
  "kernel_refs": [
    "sys/dev/raid/ida/ida_disk.c:191-211",
    "sys/dev/raid/ida/ida.c:317-362",
    "sys/dev/raid/ida/ida.c:358-359",
    "sys/dev/raid/ida/ida.c:442-468",
    "sys/dev/raid/ida/ida.c:498-537",
    "sys/platform/pc64/x86_64/dump_machdep.c:152-208",
    "sys/kern/subr_disk.c:934"
  ],
  "poc_changes": "No runnable PoC exists (hardware-gated: needs an IDA controller as dumpdev plus a failing write path). Pack carries the code trace + hardware-absence evidence; fix.diff validated with git apply --check.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "n/a \u2014 hardware-gated, no PoC build possible",
  "run_cmd": "vm.sh run_root pciconf -l | grep -i 0e11; ls /dev/idad* (result: absent/empty)",
  "code_hash": "531ad970977b64a77e4931eda87d468cb0979343cf2289dce3196b145316a7ff (sha256 of fix.diff; no PoC source exists)",
  "notes": "Filed against ida_disk.c per family convention (DF-5027 was filed against ips_disk.c while its poll helper lived in ips.c). Root cause lines live in ida.c but are NOT covered by pass-1 ida.c findings DF-1915/1916/4837 (those are detach-free, SMP queue race, DMA-direction).",
  "recommended_fix": "Record the controller status per-qcb in ida_done (qcb->error = EIO on HARD_ERROR/CMD_REJECTED) and propagate it out of ida_command after a successful wait.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (ida.c + idavar.h) stores qcb->error in ida_done before the command wakeup and returns it from ida_command when ida_wait succeeded \u2014 dump writes can now report EIO. Race-free on the polling path dumps use (crit-held, single CPU post-panic); a narrow qcb-reuse race remains on the general interrupt path (noted in-diff; full fix would hold the qcb until status is read). No hardware to build/boot a validated kernel.",
  "fix_evidence": "fix.diff (git apply --check: APPLIES_CLEAN); hunks at ida.c ida_command post-wait and ida_done pre-wakeup, idavar.h struct ida_qcb"
}