# DF-1422 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
isp_pci_mbxdma error cleanup frees DMA through stale base pointer on FC adapters

## Source Location
sys/dev/disk/isp/isp_pci.c:1629-1673

## Verdict
Source-confirmed (complex fix): isp_pci_mbxdma error cleanup frees DMA through stale base pointer on F. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
isp_pci_mbxdma at isp_pci.c:1629: FC loop bus_dmamem_alloc overwrites local base each iteration. bad: cleanup at :1670/1673 frees using stale base for ALL channels AND control area. Correct per-channel base in FCPARAM->isp_scratch. bus_dmamem_free with wrong KVA -> UAF/wrong-free. Requires FC adapter + DMA alloc failure under memory pressure. Fix: save cbase before FC loop, use FCPARAM->isp_scratch per channel.