RUNTIME OBSERVATIONS (audit guest, kernel #2 with ncr claiming QEMU lsi53c895a)

Leg A: QEMU -m 4096 (hw.physmem 4257742848 — no physical memory above 4GB)
  boot:
    ncr0: <ncr 53c895a fast40 wide scsi> port 0xc000-0xc0ff ... at device 4.0 on pci0
    interrupt uses mplock: ncr0
    (attach completes -> ncr_snooptest PASSED against the emulator)
    12x "(probeNN:ncr0:0:N:0): COMMAND FAILED (6 ff) @0xfffff8008bb9xxxx"
      -> targets 3..15 actually selected on the emulated bus and their
         CCBs completed (6=HS_RESET path); targets 0..2 (incl. the QEMU
         HARDDISK at target 0) never complete: the script-processor
         queue handshake stalls on QEMU's lsi emulation.
    stream of "ncr0: timeout nccb=0xfffff8008bb9xxxx (skip)"
      -> ncr_timeout daemon live, completing start-queued CCBs
         (count reached 90+ during the session; camcontrol rescan 2
          re-arms the cycle from userland and blocks forever on it)
    **WARNING** waiting for the following device to finish configuring:
      xpt: func=0xffffffff802acc80 arg=0
    Giving up, interrupt routing is probably hosed
    -> /dev/xpt0 eventually appears; no da/pass device on scbus2 because
       no INQUIRY ever completes through the chip.

Leg B: QEMU -m 6144 (hw.physmem 6405095424 — 2.4GB above 4GB), same kernel,
      same emulated HBA, only -m changed:
    ncr0 attaches, snooptest still passes (script images are
    kmem_alloc_contig'd below 4GB, ncr.c:3588-3605)
    BUT: 0 "COMMAND FAILED" — not a single selection completes; only the
    daemon timeout stream. The chip is fed start-queue entries whose
    DSA values come from kmalloc'd nccbs (ncr.c:6567/6577) that can now
    live above 4GB; np->squeue[] (u_int32_t, ncr.c:1081/4149) and
    jump_nccb.l_paddr (ncrcmd = u_int32_t) receive the truncated low
    32 bits -> the script processor chases garbage. No diagnostic is
    printed (silent truncation), the system stays up.

DIFFERENCE ATTRIBUTION: the only variable between legs is RAM size.
Below 4GB every physical address is representable and the chip performs
selections; above 4GB the driver's unchecked 32-bit descriptor stores
(ncr.c:4149 / 4094 / 4110 / 6701 / link.l_paddr) receive truncated
values and chip progress stops entirely. Full data-phase corruption
(MD5-level) could not be observed because the QEMU lsi emulation never
lets this 1998 script reach a data phase at any RAM size.

CONCLUSION: runtime A/B corroborates the structural defect (driver
silently non-functional/degenerate above 4GB); direct cross-memory
corruption not observed on the emulator. Honest status: inconclusive.