# DF-3774 VERDICT — not_reproduced (no AHCI hardware on guest); NULL-deref sites certain by source

## Bottom line

`ahci_set_feature()` (ahci.c:4047-4077) and `ahci_read_log()`
(ahci.c:4080-4115) call `ahci_ata_get_xfer()` (ahci.c:3669-3689) and
immediately dereference the result (`xa->fis->type = ...` at ahci.c:4059 and
ahci.c:4092) without a NULL check. `ahci_ata_get_xfer()` returns NULL whenever
the per-port free-CCB list is empty. `fis` is the first field of
`struct ata_xfer` (atascsi.h:356-358), so a NULL `xa` faults on the next line —
kernel panic.

Pool-exhaustion is reachable because CAM's devq has exactly `sc_ncmds - 1`
openings (ahci_cam.c:111-115) matching the `sc_ncmds - 1` free CCBs (slot 1
reserved, ahci.c:431-439): a burst of submissions grabs all free CCBs under
`ap_sim_lock` (ahci_cam.c:1082/1524) and holds them while blocked on the port
lock. `ahci_read_log` runs from `ahci_cam_probe_disk()` (ahci_cam.c:605) during
probe — which holds the port lock for seconds during PM probing — and
`ahci_set_feature` runs from the `hw.ahci.X.link_pwr_mgmt` sysctl
(ahci_dragonfly.c:150-162 → ahci.c:595-752) and DIPM negotiation.

Same class as DF-2420 (ahci_cam.c) and DF-2423 (ahci_pm.c); those records
cover their files' sites, these are the two unfiled ahci.c sites.

## Not-reproduced rationale

Guest has no AHCI controller (env.txt) — neither probe nor link-pm paths can
run. NULL-deref on exhaustion is certain from source; runtime frequency
depends on I/O concurrency (documented for the class in DF-2420).

## Recommended fix

Check for NULL and return EBUSSE/EIO:

```c
	xa = ahci_ata_get_xfer(ap, atx);
	if (xa == NULL)
		return (EBUSY);		/* or EIO for read_log */
```

see fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.