# DF-1444 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
Missing NULL check after ahci_ata_get_xfer in disk_io and atapi_io dispatch (defense-in-depth)

## Source Location
sys/dev/disk/ahci/ahci_cam.c:1082-1524

## Verdict
Source-confirmed: Missing NULL check after ahci_ata_get_xfer in disk_io and atapi_io dis. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
ahci_xpt_scsi_disk_io :1082 and ahci_xpt_scsi_atapi_io :1524: xa=ahci_ata_get_xfer() may return NULL on CCB pool exhaustion. No NULL check before xa->fis deref. CAM throttling prevents exhaustion in practice (sc_ncmds-1 devq). Latent defense-in-depth. Fix: add if(xa==NULL){CAM_REQUEUE_REQ;xpt_done;return;}.