# DF-3814 — VERDICT

**status: inconclusive (runtime)** — code path is unconditional and
source-certain; the guest has no SAS3 HBA to boot a controller through a
facts-changing reset.

## Source trace (why it is certain)

1. `mpr_reinit()` (mpr.c:815-902) holds `mpr_lock`, masks interrupts
   (mpr.c:842), diag-resets, then calls `mpr_iocfacts_allocate(sc, FALSE)`
   at mpr.c:861.
2. `mpr_iocfacts_allocate()`: facts-changed test mpr.c:551-576 →
   `reallocating = TRUE` → `mpr_iocfacts_free(sc)` at mpr.c:631.
3. `mpr_iocfacts_free()` mpr.c:801 calls `mpr_pci_free_interrupts(sc)` —
   real teardown per queue: `bus_teardown_intr` + `bus_release_resource`
   (mpr_pci.c:340-348). Then `sc->queues` is kfreed (mpr.c:802-803).
4. Reallocation loop mpr.c:643-653 rebuilds everything, including a fresh
   zeroed `sc->queues` (`mpr_alloc_queues`, mpr.c:1269-1270).
5. `mpr_pci_setup_interrupts()` runs only under `if (attaching && …)`
   (mpr.c:718). During reinit `attaching == FALSE` ⇒ never re-armed. The
   XXX comment above it (mpr.c:714-717) acknowledges partial awareness.
6. `mpr_reinit()` proceeds to `mpr_unmask_intr()` (mpr.c:879): firmware
   interrupts with no handler installed.

Consequences after that point: no completion interrupts ever again; polling
exists only inside `mpr_wait_command`'s no-lock branch and
`mpr_request_polled`; `mpr_read_config_page` passes timeout=0
(mpr.c:3740) ⇒ `lksleep(..., 0)` = sleep forever ⇒ permanent CAM/thread
hang; repeated sync-command timeouts re-enter `mpr_reinit` and eventually
hit `panic("%s hard reset failed …")` (mpr.c:846) or the IOC-facts panic
(mpr.c:862).

## Runtime

Not testable on this guest: `kldstat -v | grep -w mpr` → `142 pci/mpr`
(driver present), but no LSI PCI device and no `/dev/mpr*` (probe.log).
Neither baseline nor patched behavior can be observed → inconclusive /
not_testable for the fix.

## Fix

`fix.diff`: also run `mpr_pci_setup_interrupts()` when `reallocating`
(the IRQ resources were released with the same `sc->irq_rid`, so
re-allocation by rid is symmetric with attach).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.