# DF-1223 — mpr XCT_RESET_DEV pool mismatch

## Reproduce

Not runnable on the audit guest — no LSI MPT-Fusion SAS controller is
attached. The verification is a static source trace + a compiling `fix.diff`.

To **validate the fix compiles**, after applying `fix.diff` to `/usr/src`:
```sh
cd /usr/src
make -j6 nativekernel KERNCONF=X86_64_GENERIC
```

## Bug location
`sys/dev/raid/mpr/mpr_sas.c:3351` — `mprsas_action_resetdev()` allocates
with `mpr_alloc_command(sc)` (regular pool) but frees via
`mprsas_free_tm` → `mpr_free_high_priority_command` (high-pri pool). Every
other TM path uses `mprsas_alloc_tm(sc)`. Each reset leaks a regular slot
and corrupts the high-pri list with out-of-range SMIDs; after N resets,
`mpr_alloc_command` returns NULL → disk I/O stall.

## Trigger preconditions (NOT met on this guest)
- An LSI MPT-Fusion SAS controller (mpr-attached) with a target.
- A user able to issue `camcontrol reset <target>` (operator group).

## On a system WITH an mpr target, the PoC is:
```sh
for i in $(seq 1 200); do camcontrol reset da0; done
# dmesg: "command alloc failure in mprsas_action_resetdev"; disk I/O stalls
```

## Files
- `VERDICT.md`, `fix.diff`, `env.txt`, `build.log`.