# DF-1318 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
NULL cam_path dereference in sbp_target_reset iterating all LUNs

## Source Location
sys/dev/disk/sbp/sbp.c:2098-2106

## Verdict
Source-confirmed: NULL cam_path dereference in sbp_target_reset iterating all LUNs. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
sbp_target_reset at sbp.c:2098-2106: loops all LUNs, skips only SBP_DEV_DEAD/RESET, then xpt_freeze_devq(tsdev->path,1) without NULL check. sbp_cam_detach_sdev frees path and sets NULL but does NOT set status=RESET. Race: detach_target iterating LUNs + concurrent timeout callout for another LUN -> sbp_target_reset hits freed path -> NULL deref in xpt_freeze_devq. sbp_recv1:1664 correctly guards with if(sdev->path). Fix: add if(tsdev->path==NULL) continue.