# Fixture f4 — verdict recount mismatch (expect: FAIL via R3)

## Verdict table

| # | Documented vuln | Location | Scanner result | Verdict |
|---|---|---|---|---|
| 1 | SQLi in login | a.js:1 | sqli HIGH | HIT |
| 2 | XSS in profile | b.js:2 | xss MED | HIT |
| 3 | CSRF missing | c.js:3 | nothing | MISS |
| 4 | SSRF param | d.js:4 | ssrf HIGH | PARTIAL |
| 5 | IDOR | e.js:5 | fixed already | n/a |

- **Instance level (4 in-scope): 3 HIT / 0 PARTIAL / 1 MISS**
  (declared 3 HIT but table recounts 2 — fixture exercises R3)