# DF-1814 — verification verdict

| Field | Value |
|-------|-------|
| **Verdict**     | SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest) |
| **Impact**      | queue corruption |
| **Confidence**  | certain (source-trace) |
| **Guest**       | DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64 |
| **Module/kernel** | not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel |
| **Citations**   | sys/dev/raid/twa/tw_cl_init.c:677, sys/dev/raid/twa/tw_cl_init.c:705 |

## Mechanism

tw_cli_init_connection at 677-680 calls tw_cli_submit_and_poll_request; on error goto out. The out: path at 705-706 unconditionally does tw_cli_req_q_insert_tail(req, TW_CLI_FREE_Q). But submit_and_poll_request's contract (tw_cl_io.c:999-1006, 1024): on ETIMEDOUT with PENDING, the request is ALREADY inserted into FREE_Q. The unconditional insert double-inserts, corrupting the free queue.

**Root cause:** Unconditional FREE_Q insert ignores submit_and_poll_request's timeout-cleanup contract.

## Reproduction note (HW/module-gated)

DF-1814 lives in `sys/dev/raid/twa/tw_cl_init.c` which is either (a) not compiled into the
default `X86_64_GENERIC` kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt
driver only — loaded via kldload) or (b) gated by absent hardware on this
audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID
controller, no CardBus bridge). The bug is **source-confirmed** by tracing
the cited path line-by-line; a live trigger would require the corresponding
hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build
validated in this run.

## Fix

Skip the FREE_Q insert when error == TW_OSL_ETIMEDOUT. Matches finding proposal.


## Phase 8 — combined fix-kernel build validation

`fix.diff` was one of 35 standalone `git apply`-able patches batched into a single
`make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest.

**Result:** combined kernel build **rc=0** with `-Werror` clean (no warnings).

- Build log: `combined_build.log` (35666 lines, full untrimmed `make` output).
- Single-fix kernel artifact:
  `/usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped`
  sha256 `eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7`,
  built `Wed Jul 22 15:42:55 UTC 2026`.
- All 35 patches applied cleanly via `patch -p1 --forward` (no rejects).

Because DF-1814 is HW/module-gated (not compiled into the default GENERIC kernel
or requires hardware absent on the audit guest), the combined kernel was not
booted for a runtime re-test; the source-level correctness of the fix is
validated by the rc=0 -Werror build, which is the appropriate validation for
HW-gated findings.