# DF-3774 — ahci_set_feature() / ahci_read_log(): unchecked NULL from ahci_ata_get_xfer() → NULL-pointer kernel panic under CCB-pool exhaustion

File: `sys/dev/disk/ahci/ahci.c` (pass 2, GLM 5.3)

## What the bug is

`ahci_ata_get_xfer()` (ahci.c:3669-3689) returns **NULL** when the per-port
CCB free list is empty (`ahci_get_ccb()` → NULL). Two ahci.c callers never
check:

```c
int
ahci_set_feature(struct ahci_port *ap, struct ata_port *atx, ...)
{
	...
	xa = ahci_ata_get_xfer(ap, atx);     /* ahci.c:4057 */
	xa->fis->type = ATA_FIS_TYPE_H2D;    /* ahci.c:4059 — NULL deref */
	...
}

int
ahci_read_log(struct ahci_port *ap, struct ata_port *atx, ...)
{
	...
	xa = ahci_ata_get_xfer(ap, atx);     /* ahci.c:4090 */
	xa->fis->type = ATA_FIS_TYPE_H2D;    /* ahci.c:4092 — NULL deref */
	...
}
```

`fis` is the first member of `struct ata_xfer` (atascsi.h:356-358), so the
fault is a read of `*(NULL + 0)` → kernel panic.

This is the same defect class already filed for the sibling files:
**DF-2420** (ahci_cam.c dispatch sites) and **DF-2423** (ahci_pm_read/write).
These two ahci.c sites were not covered by either record.

## Reachability

The CCB pool is `sc_ncmds - 1` deep (slot 1 is the reserved error CCB,
ahci.c:431-439) and CAM's devq is sized to exactly `sc_ncmds - 1` openings
(ahci_cam.c:111-115), so ordinary CAM I/O alone can hold **every** free CCB —
in particular CCBs in the window where `ahci_xpt_scsi_*_io()` has taken a CCB
(ahci_cam.c:1082/1524, under `ap_sim_lock` only) but is blocked in
`ahci_ata_cmd()` on the port lock.

- **ahci_read_log** is called from `ahci_cam_probe_disk()` (ahci_cam.c:605,
  DevSleep identify support) during (re)probe, which runs while the port lock
  is held for seconds (PM probe sleeps 5s) — CAM submissions from other CPUs
  can hold all free CCBs in that window → NULL deref.
- **ahci_set_feature** is called from `ahci_port_link_pwr_mgmt()` (ahci.c:634,
  641, 688, 695, 718, 721 — sysctl `hw.ahci.X.link_pwr_mgmt`, root-gated) and
  from DIPM/APST negotiation.

Impact: NULL-deref panic (local DoS). Combined severity capped at Low for this
file's sites (probe-path variant is hotplug/PM-conditioned; sysctl variant is
root-gated) — see DF-2420/2423 for the class discussion.

## Why not reproduced on the guest

No AHCI controller on the audit guest (env.txt); the probe/link-pm paths
cannot execute. Class precedent (DF-2420) documents the exhaustion mechanics.