{
  "finding_id": "DF-3773",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "ahci_beg_exclusive_access() (ahci.c:2262-2270) drains active commands with only ahci_port_intr(), but a deferred-expired CCB (timeout fired while other commands active - ap->ap_expired set, CCB not completed, ahci.c:3873-3884) can never be retired by that loop because its hardware CI/SACT bit never clears and ahci_check_active_timeouts() is never called - even though ahci_poll()s equivalent loop does call it (ahci.c:2160-2163) for exactly this reason. The loop then spins forever holding the port lock; the port interrupt handler deflects to the also-blocked port thread (ahci.c:2514-2517), permanently wedging the port and a kernel thread. Requires PM hardware plus a hung target - DoS only. Not reproduced: guest has no AHCI controller.",
  "exploit_chain": "",
  "evidence": "VERDICT.md; ahci.c:2262-2270 (loop without timeout processing) vs ahci.c:2154-2168 (ahci_poll loop WITH it); ahci.c:3873-3884 (deferred timeout); ahci.c:3152 (completion walk cannot retire hung slots); ahci.c:938 (caller under port lock)",
  "kernel_refs": [
    "sys/dev/disk/ahci/ahci.c:2262",
    "sys/dev/disk/ahci/ahci.c:2266",
    "sys/dev/disk/ahci/ahci.c:2162",
    "sys/dev/disk/ahci/ahci.c:3873",
    "sys/dev/disk/ahci/ahci.c:2514"
  ],
  "poc_changes": "No runtime PoC possible - needs AHCI + port-multiplier hardware with a hung target.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "notes": "Logic gap is definite; the ahci_poll() comment at ahci.c:2187-2189 states the deadlocked-callout rationale verbatim, which the beg_exclusive loop violates.",
  "recommended_fix": "Call ahci_check_active_timeouts(ap) inside the beg_exclusive_access drain loop (one line), mirroring ahci_poll().",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line fix authored; no hardware to validate against.",
  "fix_evidence": "fix.diff in this pack."
}