# DF-2475 — Wrong bitmask includes task-attribute bits in IU length

## Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

## Hardware gate

No QLogic ISP HBA in guest: `kldstat` shows only kernel/ehci/xhci; `pciconf -l`
shows no QLogic device. ISP target mode is never active.

## Source trace (confirmed real bug)

**File:** `sys/dev/disk/isp/isp_target.c:174`

```c
len = at7iop->at_ta_len & 0xfffff;   // line 174
```

`at_ta_len` is declared `uint16_t` (`ispmbox.h:2135`), packing
`[task_attribute:4 bits 12-15][IU_length:12 bits 0-11]`. The mask `0xfffff` is
20 bits wide, which is a **no-op on a 16-bit value** — it fails to strip the
task-attribute nibble (bits 12-15). Any FCP_CMND with a non-zero task attribute
(ORDERED=2, HEAD_OF_QUEUE=1, ACA=4) is misclassified: e.g., for ORDERED,
`at_ta_len = (2<<12)|0x20 = 0x2020`, so `len` becomes 8224 instead of 32. The
test `len > (QENTRY_LEN - 8)` is true, and the loop at 178-181 advances `*optrp`
by 128+ positions around the 1024-entry ATIO ring, silently dropping that many
pending ATIO/NOTIFY entries.

## Fix

Changed mask from `0xfffff` to `0xfff` (12-bit IU length, stripping the 4-bit
task-attribute field). See `fix.diff`.

## Impact (on HW that has the HBA)

High — remote DoS: any FC initiator on the fabric sends one SCSI command with a
non-SIMPLE task attribute and the ATIO ring consumer silently drops 128-960
entries, breaking exchange cleanup for other initiators.