# DF-2264 verification pack — saioctl control-device lock leak

Bug: `sys/bus/cam/scsi/scsi_sa.c:849-920` — `cam_periph_lock(periph)` at
:849, three early returns (:878, :914, :920) bypass the single unlocking
exit at :1345-1348. Every later CAM operation on the SIM blocks forever.

## Rig

Same harness kernel as DF-2263 (see ../DF-2263/README.md); the REAL
`saioctl()` runs against fabricated-but-real-lockmgr state (real struct
lock, cam_sim->lock, cam_periph->softc, cdev with si_uminor = 1<<29 for
SA_IS_CTRL, registered via the real cam_extend_set into saperiphs).

## Build

    ./build.sh      # or reuse the kernel built from ../DF-2263

## Run

    vm.sh run_root 'sysctl debug.df226x.t2264a=1'
    vm.sh run_root 'sh -c "(sleep 1; kill -USR1 \$\$) & exec sysctl debug.df226x.t2264b=1"'
    vm.sh run_root 'dmesg | grep DFH2264'

## Expected

Unpatched: EINVAL/EINTR returned with `SIM lock status AFTER return: 2`
(LK_EXCLUSIVE) and `probe thread still BLOCKED after 1s: SIM-wide wedge
confirmed`. Patched: status 0, probe acquires.

Artifacts: VERDICT.md, df_pre.c, df_post.c, gen.sh, build.sh, quick.sh,
run_unfixed.dmesg, run_fixed.dmesg, env.txt (in ../DF-2263), fix.diff.