# DF-3673 — mpt_timeout() uses the CCB after xpt_done() hands it back

**Severity: Medium (memcorrupt) — source-provable race; runtime-gated on MPT hardware.**

## Build / Run (host with an mpt-attached LUN)

    cc -O -o mpt_timeout_race mpt_timeout_race.c
    ./mpt_timeout_race /dev/passN

Hammer the device with 1 ms-timeout READ(6)s; every completion that lands in
the callout-callback window makes mpt_timeout() re-enter with a freed /
recycled CCB (`mpt_cam.c:1240-1252` vs completion at `:2662/:2710`).

Expected on vulnerable kernel under load: kernel panic (wild `req` pointer
read via `req->serno`), or spurious abort of an unrelated command with
pending/timeout-list confusion.

## Why this guest cannot run it

Same as DF-3672: mpt is compiled in (X86_64_GENERIC:93) but the QEMU guest
has no LSI PCI device — no mpt bus, no I/O, no callouts armed by this driver.

See VERDICT.md for the full interleaving proof and env.txt for the probe.