DF-3917
_mapping_find_enc_map_space clears the WRONG enclosure entry (et_entry instead of enc_entry) and its overlap test is off by one, clearing a map slot beyond the enclosure
Summary
When reclaiming space from missing enclosures: the overlap test uses > instead of >=, so one-past-the-last-slot matches and clears a mapping entry belonging to the next enclosure; and when the consumed enclosure's last slot is reached, the clear call wipes the NEW enclosure being placed instead of the consumed missing one. Mapping/enclosure-table corruption during space reclamation: the newly placed enclosure loses its metadata and a foreign map entry is cleared, dropping another enclosure's devices. In-bounds writes only. Upstream FreeBSD head shares both defects verbatim.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3917 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 449 B | view raw |
Confirmed kernel references
β
Detail
Evidence (decisive lines)
β
Verdict
Low - PoC skipped per contract (hardware-gated logic/error-path classes). Source-certain; fixes authored; DF-3916/3917 also reported against FreeBSD head.
No comments yet.