# DF-3696 VERDICT

**Status: reproduced** (dos — boot-time system wedge; the "README expects
hang/loop" case).

## Reproduction
Crafted Promise/FreeBSD-native RAID5 metadata (width=2, total_disks=2, one
disk ONLINE, one absent) on `ata0-master`. The array assembled as DEGRADED
(READY retained by `ata_raid_config_changed:955-965`):

```
ar0: WARNING - parity protection lost. RAID5 array in DEGRADED mode
ar0: 48MB <FreeBSD PseudoRAID RAID5 (stripe 0 KB)> status: DEGRADED
ar0: disk0 READY using ad0 at ata0-master
ar0: disk1 DOWN no device found for this subdisk
```

The kernel's slice-scan of /dev/ar0 then issued the first bio;
`ata_raid_strategy:609-611` fell through the empty DEGRADED branch: the
request allocated at `:386` was never queued or freed and the bio was never
completed. Serial output stops exactly there (no `ar0: MBR magic not found`
line, which requires a completed probe read); ssh never came up within 220 s;
`vm.sh status` → down. Guest hard-reset required.

## Primitive characterization
- Demonstrated: full system wedge at boot (persistent DoS) from one crafted
  disk, zero interaction.
- Per-request kernel memory leak (`struct ata_request` from the objcache) for
  every chunk of every bio — source-certain (`:386` alloc vs no
  free/complete on the `:609` path); not separately metered in this run
  because the first hung bio already stops userspace from using the device.
- The same hole affects runtime operation of legitimately-built degraded
  RAID5 arrays: each read/write hangs unkillably and leaks.

## Fix validation
fix.diff replaces the empty branch with `ata_free_request(request);
biofinish(bp, NULL, EIO); return(0);` — matching the error style of the
neighboring paths. Patched kernel + same disk: ar0 announced DEGRADED, I/O
returns EIO, boot reaches login (`run.patched.log`). fix_status = fixed.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.