# DF-2483 — mpt_pci_attach returns success on every failure path

## Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

## Hardware gate

No LSI Logic MPT HBA in guest: `kldstat` shows only kernel/ehci/xhci; `pciconf -l`
shows no LSI device. mpt PCI attach is never called.

## Source trace (confirmed real bug)

**File:** `sys/dev/disk/mpt/mpt_pci.c:597-609`

The `bad:` error label unconditionally `return (0)` (success) at line 609:
```c
bad:
    mpt_dma_mem_free(mpt);
    mpt_free_bus_resources(mpt);
    ...
    return (0);   // ← BUG: returns success despite failure
```
Newbus believes the device is `DS_ALIVE` and invokes `mpt_pci_detach` on
kldunload/hot-unplug even when attach never completed. `mpt_pci_detach` calls
`mpt_detach` which performs unconditional `TAILQ_REMOVE`. For the disabled-device
path, `softc->links.tqe_prev` stays NULL, so `TAILQ_REMOVE` writes to NULL → panic.
For the inner-attach-failure path, double `TAILQ_REMOVE` corrupts the global
`mpt_tailq` head.

## Fix

Changed `return (0)` to `return (ENXIO)` on the error path. See `fix.diff`.

## Impact (on HW that has the HBA)

Low — panic or list corruption on kldunload/hot-unplug after failed attach.