{
  "finding_id": "DF-5286",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Not executed (Low-severity hardening finding; Phase V skipped per contract). Static proof: samount() kmallocs the 8192-byte READ BLOCK LIMITS scratch without M_ZERO (scsi_sa.c:1961) and parses gran/maximum/minimum from it (scsi_sa.c:2007-2019) with no short-transfer check - a device that completes RBL with a short transfer leaves blk_gran/max_blk/min_blk derived from stale kernel heap. Consequence is state-only (RBL_GRAN is masked to 5 bits; max/min only gate request sizes in sastrategy and feed the DF-5285 modulo), with no copyout of the bytes, hence Low. The M_ZERO hunk is included in the DF-5285 fix.diff and was compile-validated with that kernel build.",
  "exploit_chain": "",
  "evidence": "scsi_sa.c:1961,1988-1994,2007-2019 (cited in finding); fix.diff hunk 2; evilsa.c rbl_short choreography available if triage wants a live run",
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_sa.c:1961",
    "sys/bus/cam/scsi/scsi_sa.c:1988",
    "sys/bus/cam/scsi/scsi_sa.c:2007",
    "sys/bus/cam/scsi/scsi_sa.c:2019"
  ],
  "poc_changes": "evilsa.c carries a ready rbl_short=1 mode (zero-length RBL transfer); not run",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "evilsa.c: 968557745b0f060df9477a1280e6b4db9a7dbc0e807c5921babe83937a457d06",
  "notes": "Low severity hardening; same class as DF-5284 (non-zeroed kmalloc + short transfer) but no exfiltration path - the stale bytes only steer softc geometry state.",
  "recommended_fix": "kmalloc rblim with M_ZERO (included in DF-5285 fix.diff hunk 2).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "M_ZERO hunk compiled as part of the DF-5285 fix kernel build (fix_build.log) but the short-RBL scenario itself was not executed",
  "fix_evidence": "findings/poc/DF-5285/fix_build.log"
}