{
  "finding_id": "DF-5050",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated: the sink is the kernel crash-dump path and the guest has no MegaRAID controller (env.txt), so no runtime reproduction was possible. The source chain is deterministic: mfi_syspd_dump (mfi_syspd.c:301-304) forwards dump writes to mfi_dump_syspd_blocks (mfi.c:2477), whose polled transport mfi_send_frame returns 0 for ANY firmware completion status except timeout (mfi.c:2316-2322) \u2014 the dump path never re-checks pass->header.cmd_status/scsi_status, so firmware-rejected WRITE_10s (dead/removed/faulted PD) are acknowledged chunk-by-chunk and savecore believes an empty/corrupt dump. DF-5027 shape on the mfi syspd path.",
  "exploit_chain": "",
  "evidence": "VERDICT.md source chain (path:line for all four links incl. the contrast with mfi_bio_complete which DOES check cmd_status); env.txt hardware absence; fix.diff compile validation",
  "kernel_refs": [
    "sys/dev/raid/mfi/mfi_syspd.c:287",
    "sys/dev/raid/mfi/mfi_syspd.c:301",
    "sys/dev/raid/mfi/mfi.c:2439",
    "sys/dev/raid/mfi/mfi.c:2477",
    "sys/dev/raid/mfi/mfi.c:2316",
    "sys/dev/raid/mfi/mfi.c:2322"
  ],
  "poc_changes": "No seed PoC; none possible (kernel crash-dump path). Pack documents the source chain instead.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "n/a (kernel dump path; fix compile-validated via cd /usr/src && patch -p1 < fix.diff && make -DNO_CLEAN nativekernel KERNCONF=X86_64_GENERIC)",
  "run_cmd": "n/a on this guest (hardware-gated)",
  "code_hash": "cf54ef391c64a6672e33bdb4a1611389a851f3cbf730a5725063ba07c9e1ccbe (fix.diff)",
  "notes": "LD twin (mfi_dump_blocks/mfi_disk_dump) shares the omission \u2014 mfi_disk family follow-up. The len==0 sync-cache no-op noted in VERDICT.md is upstream-inherited and not the finding.",
  "recommended_fix": "After mfi_mapcmd in mfi_dump_syspd_blocks, fail with EIO when pass->header.cmd_status != MFI_STAT_OK || scsi_status != 0 (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff applied cleanly on the guest /usr/src copy and compile-validated (make -DNO_CLEAN nativekernel KERNCONF=X86_64_GENERIC -> completed, exit 0); source reverted and verified byte-identical. Dump-path behavior not exercisable without hardware.",
  "fix_evidence": "VERDICT.md guest-evidence section"
}