# DF-2501 verdict -- XPT_RESET_DEV dereferences softc->atadev[tid] with no NULL/bounds check

status: reproduced   reproduced: 1   impact: panic
confidence: certain   attempts: 2   runtime_sec: 700

The verbatim atapi_action XPT_RESET_DEV case (atapi-cam.c:428-432) evaluates softc->atadev[tid]->dev with neither the NULL guard XPT_PATH_INQ applies at :385 nor the guard XPT_SCSI_IO applies at :490. Dispatching XPT_RESET_DEV with atadev[0] == NULL (the state reinit_bus leaves behind) panicked the kernel at the exact deref: Fatal trap 12, fault VA 0x0, stopped at the movq through the NULL atadev - the precise instruction the finding cites. Fixed source A/B: the same dispatch returns CAM_DEV_NOT_THERE (xpt_done status=0x8 logged) and the guest survives. Trigger model per the filing: CAM dispatch racing atacontrol reinit/hot-plug - privileged/physical context; the pass(4) route to XPT_RESET_DEV is also gated by raw-device permissions on this system.

## Evidence (decisive lines)
(kernel serial console)
Fatal user address access from kernel mode from sysctl at ffffffff82606e66
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x0
Stopped at      dfv_acam_sysctl+0x116:  movq    (%rax),%rcx      <- atadev[tid]->dev, rax=0
--- fixed source A/B ---
DF2501: log: xpt_done(status=0x8)          <- CAM_DEV_NOT_THERE, guest survives



## Panic
```
Fatal user address access from kernel mode from sysctl at ffffffff82606e66
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
Stopped at      dfv_acam_sysctl+0x116:   movq    (%rax),%rcx
(trace: verbatim atapi_action XPT_RESET_DEV -> softc->atadev[0]->dev with atadev[0]=NULL, atapi-cam.c:432)
```


## Exploit chain / privesc assessment
deterministic kernel NULL-deref panic; privesc ceiling: none (DoS).

## Fix + A/B
fix.diff adds the same NULL/bounds guard XPT_SCSI_IO uses; A/B survives with CAM_DEV_NOT_THERE.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.