# DF-2420 — run.log (verbatim ssh session outputs, 2026-10-15, stock kernel)
# guest: ahci0.0 DISK -> da0/pass0 (scbus2); ahci0.1 ATAPI -> cd0/pass1 (scbus3)

# ============ 1. live-hardware churn (negative control, tags=32/32) ============
$ for i in $(seq 1 32); do (dd if=/dev/da0 of=/dev/null bs=64k count=400 ...) & done; ...
32                                # all dd succeeded, guest healthy

$ sh /root/flood2.sh              # 48 concurrent FULL-disk reads (48x512MB,
                                  # ~30s sustained) + pass-CCB READ_10 storm
tail: 48 x "rc=0", "passstorm ccb count: N"
 1:33AM  up 7 mins ...            # no crash, no ahci errors in dmesg
#  -> with tags=32/32 (QEMU disk advertises ncqdepth == sc_ncmds) the probe
#     prune loop (ahci_cam.c:386-392) removes no slots, CAM devq (ncmds-1)
#     can never exhaust the 32-slot free list: the NULL path is NOT
#     reachable on this emulated hardware by pure I/O load.

# ============ 2. production-path trigger via free-list drain rig ============
$ sysctl dev.df2420rig="hold 0" >/dev/null; sleep 1; ./ahcipoc read10
df2420rig: port 0 drained - holding 31 ata_xfers, ap_ccb_free is now EMPTY
Fatal user address access from kernel mode from ahcipoc at ffffffff80305609
Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address   = 0x60
fault code               = supervisor write data, page not present
instruction pointer      = 0x8:0xffffffff80305609
...
Stopped at      ahci_xpt_scsi_disk_io+0x8f9:    movl    $0x1,0x60(%r12)
db>
#  ^ xa = ahci_ata_get_xfer() returned NULL (ahci.c:3670); the READ_10 path
#  executes `xa->flags = ATA_F_READ` (ATA_F_READ==1, offset 0x60) on NULL.
#  r12 = NULL xa. Production function, real pass CCB, real driver state.

$ sysctl dev.df2420rig="hold 1" >/dev/null; sleep 1; ./ahcipoc -d /dev/pass1 atapi 00 00 00 00 00 00
df2420rig: port 1 drained - holding 31 ata_xfers, ap_ccb_free is now EMPTY
Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address     = 0x0
fault code                 = supervisor read data, page not present
instruction pointer        = 0x8:0xffffffff80306816
...
Stopped at      ahci_xpt_action+0x2d6:   movq    (%rax),%rax
db>
#  ^ ahci_xpt_scsi_atapi_io inlined into ahci_xpt_action: xa==NULL deref at
#  `fis = xa->fis` / fis->flags = ... (read fault at 0x0).

# (full panic text: panic-disk.txt, panic-atapi.txt; rig: df2420_rig.c)