# DF-3661 VERDICT — per-channel cam_simq_release on a once-referenced shared devq

## Status: not_reproduced (no QLogic hardware on guest; arithmetic is source-certain)

## Analysis

The devq reference protocol in DragonFly CAM:

* `cam_devq_alloc` → `refcount = 1` (cam_queue.c:228).
* `cam_sim_alloc(action, poll, name, softc, unit, lock, maxdev, maxtagged, queue)`
  **takes** one reference per sim when a non-NULL queue is supplied
  (`cam_sim.c:182-185`: `else cam_devq_reference(queue)`).
* `cam_sim_free` → `cam_sim_release` drops that sim's reference when the sim
  dies (`cam_sim.c:246-252`).
* `cam_devq_release` is `if (--refcount == 0) { camq_fini x2; kfree(devq) }`
  (cam_queue.c:248-256). No underflow protection.

The driver:

* `isp_attach` allocates the devq once (isp_freebsd.c:213) and hands the same
  pointer to every `isp_attach_chan` (isp_freebsd.c:219-223).
* Each `isp_attach_chan` — right after its `cam_sim_alloc` — executes
  `cam_simq_release(devq)` (isp_freebsd.c:95). This is patterned on
  single-channel drivers where the caller's reference is dropped exactly once
  after handing it to the (sole) sim. Applied per channel, every channel
  after the first decrements a reference owned by a live sim.

Net: for nchan = N the steady-state refcount is 1 instead of N.

## Failure sequence at teardown (isp_detach, isp_freebsd.c:290-309)

1. chan N−1: `cam_sim_free(sim)` → `--refcount` → 0 → **devq kfree'd**.
2. Between step 1 and the last `cam_sim_free`, the remaining N−1 sims are
   still registered; their buses' CCB flow (`xpt_run_devq`, allocation
   openings) dereferences `sim->devq` → **use-after-free** reads/writes of
   `alloc_queue`/`send_queue` state.
3. Each later `cam_sim_free` calls `cam_simq_release(sim->devq)` →
   `--freed->refcount` → **write-after-free**; if the decremented value is 0
   the devq is kfree'd a second time.

Identical over-release executes in `isp_attach`'s unwind (:235-251) when a
later channel fails to attach.

## Affected hardware (this tree)

* PCI_QLOGIC_ISP1240, ISP12160 (dual SCSI, `isp_nchan = 2`; isp_pci.c:732/749).
* ISP2422/2432/2532 with NPIV virtual ports (`isp_nchan += isp_nvports`;
  isp_pci.c:798/805 — nvports hint, up to ~126 channels).
* Single-channel cards (the vast majority) balance exactly — N=1 is safe,
  which is why this survived: the common configuration never trips it.

## Why not reproduced

Guest has zero QLogic PCI devices (vendor 0x1077) — isp never attaches, so
neither the over-release nor the premature free can execute (run.log /
env.txt). The refcount walk is fully determined by source; upstream FreeBSD
(fetched 2026-09-15) releases the devq only once, after all sims are gone,
in both unwind and detach — confirming the intended protocol.

## Exploitability

Write-after-free of a fixed-size `cam_devq` (M_CAMDEVQ) triggered by root
teardown on specific multi-channel hardware; heap-reuse steering would be
required to convert to more than a panic. Not pursuable without the HBA.

## Fix

`fix.diff`: delete `cam_simq_release(devq)` from `isp_attach_chan`; drop the
caller's single reference in `isp_attach` unwind and `isp_detach` after all
sims are freed (upstream pattern). Not runtime-validatable on this guest
(no hardware) → `fix_status: not_testable`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.