# DF-1744 — verification verdict

| Field | Value |
|-------|-------|
| **Verdict**     | SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest) |
| **Impact**      | UAF/panic (detach race) |
| **Confidence**  | certain (source-trace) |
| **Guest**       | DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64 |
| **Module/kernel** | not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel |
| **Citations**   | sys/dev/disk/mpt/mpt_pci.c:655 |

## Mechanism

mpt_pci_detach at 655-660 order: mpt_disable_ints -> mpt_detach -> mpt_reset -> mpt_raid_free_mem -> mpt_dma_mem_free -> mpt_free_bus_resources (which contains the bus_teardown_intr at 619). The interrupt handler can still fire during the window between detach start and teardown_intr, executing on freed memory.

**Root cause:** bus_teardown_intr called too late in the detach sequence.

## Reproduction note (HW/module-gated)

DF-1744 lives in `sys/dev/disk/mpt/mpt_pci.c` which is either (a) not compiled into the
default `X86_64_GENERIC` kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt
driver only — loaded via kldload) or (b) gated by absent hardware on this
audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID
controller, no CardBus bridge). The bug is **source-confirmed** by tracing
the cited path line-by-line; a live trigger would require the corresponding
hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build
validated in this run.

## Fix

Move mpt_free_bus_resources() to first in the detach order so the IRQ is torn down before any softc state is freed. Matches finding proposal.


## Phase 8 — combined fix-kernel build validation

`fix.diff` was one of 35 standalone `git apply`-able patches batched into a single
`make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest.

**Result:** combined kernel build **rc=0** with `-Werror` clean (no warnings).

- Build log: `combined_build.log` (35666 lines, full untrimmed `make` output).
- Single-fix kernel artifact:
  `/usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped`
  sha256 `eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7`,
  built `Wed Jul 22 15:42:55 UTC 2026`.
- All 35 patches applied cleanly via `patch -p1 --forward` (no rejects).

Because DF-1744 is HW/module-gated (not compiled into the default GENERIC kernel
or requires hardware absent on the audit guest), the combined kernel was not
booted for a runtime re-test; the source-level correctness of the fix is
validated by the rc=0 -Werror build, which is the appropriate validation for
HW-gated findings.