# VERDICT — DF-1126

## Verdict: REPRODUCED (primitive) / NOT REACHABLE on guest (HW-gated)

The cited bug is **real and confirmed** by source trace + userspace
loop-bookkeeping demonstration. It is a **latent** infinite-loop / hang
primitive requiring `ISP_TARGET_MODE` compiled (not default) and a
target-mode FC adapter receiving an Extended CDB/IU.

## Mechanism (confirmed path:line)
1. `isp_intr` (`sys/dev/disk/isp/isp.c:5112-5124`) processes response
   queue entries. For unrecognized entry types it calls
   `isp_handle_other_response(isp, etype, hp, &tsto)` (`:5113`) where
   `tsto` is a local initialized to `oop`.
2. `isp_handle_other_response` (`:5964-6022`) for `RQSTYPE_ATIO` etc.
   calls `isp_target_notify(isp, hp, optrp)` (`:5988`) inside
   `#ifdef ISP_TARGET_MODE`.
3. `isp_target_notify` (`sys/dev/disk/isp/isp_target.c:104`) for an
   `RQSTYPE_ATIO7` (`IS_24XX`) with a long IU (`at_ta_len > QENTRY_LEN-8`)
   advances `*optrp` in a loop at `:178-181`:
   `*optrp = ISP_NXT_QENTRY(*optrp, RESULT_QUEUE_LEN(isp))`.
4. Back in `isp_intr:5121-5124`:
   ```c
   while (tsto != oop) {
       optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp));
   }
   ```
   The body assigns to `optr` but **never modifies `tsto` or `oop`**.
   After `isp_target_notify` advanced `tsto` past `oop`, the condition is
   invariantly true → infinite spin in hard interrupt context → permanent
   kernel hang.

## Reproduction (userspace harness)
The harness simulates the queue pointers, calls a stand-in for
`isp_handle_other_response` that advances `tsto` by one slot, then runs
the exact kernel loop body (capped at 1M iterations to prove
non-termination rather than actually hang):
```
oop  = 100
tsto = 101  (advanced by isp_target_notify long-IU path)
Hit iteration cap (1000000) without termination.
tsto before loop = 101, tsto after = 101 (UNCHANGED)
*** LOOP DID NOT ADVANCE tsto -- infinite loop confirmed ***
```

## Impact ceiling
- **Per-trigger**: permanent kernel hang in hard interrupt context. The
  CPU spinning in `isp_intr` cannot be preempted; the system is wedged.
- **Privilege**: remote — a FC initiator sending an Extended CDB/IU > 56
  bytes triggers it. Requires target-mode FC adapter with
  `ISP_TARGET_MODE`.
- **Realistic**: doubly gated (`ISP_TARGET_MODE` not default + FC target
  role). Niche but remote-triggerable when configured.

## Fix
`fix.diff` changes `while` to `if`:
```c
if (tsto != oop) {
    optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp));
}
```
The body was always meant to run at most once (it only computes the next
`optr` from the updated `tsto`). The `while` was a latent bug because the
body never advances the loop variables.

Validated: `isp.ko` builds with `RC=0` after applying the fix.

## Fix validation
- Patch applies cleanly: `Hunk #1 succeeded at 5114`.
- `make` in `sys/dev/disk/isp/` → `isp.ko` + all FC firmware modules
  linked, `ISP_RC=0`.
- Cannot boot-test (no QLogic ISP FC adapter + no `ISP_TARGET_MODE`);
  `fix_status: not_testable`.

## PoC changes
- `harness.c` written from scratch. Simulates queue pointers and proves
  the loop body never advances `tsto` (capped at 1M iters).