# VERDICT — DF-3825

**Status: not_reproduced** (the audit guest has no DPT/Adaptec I2O
controller: `/dev/asr0` → ENOENT for both root and an unprivileged
user; zero PCI devices with vendor 0x1044; the asr driver is compiled
into X86_64_GENERIC but never attaches).  **Source-level confidence:
certain.**

## The four unbounded waits

| # | site | loop | caller context | effect when adapter is deaf |
|---|------|------|----------------|------------------------------|
| 1 | asr.c:1254 (`ASR_reset`) | `while (ASR_resetIOP(sc) == 0);` | `crit_enter()` region; reached from `asr_timeout` callout (:1297/:1314), `XPT_RESET_DEV` (:2744), `I2ORESETCMD` ioctl (:3793) | infinite spin with interrupts blocked on that CPU → system-wide hang/watchdog |
| 2 | asr.c:1892 (`ASR_initOutBound`) | `while (*Reply_Ptr < I2O_EXEC_OUTBOUND_INIT_REJECTED);` — zero timeout | boot, `ASR_reset`, and directly the `I2OUSRCMD` ioctl via `ASR_queue_i` (:3211-3219) | unbounded busy loop on a DMA'd word with card interrupts masked |
| 3 | asr.c:727 (`ASR_queue_s`) | `while (status == CAM_REQ_INPROG) (void)asr_intr(sc);` | every synchronous config path (LCT/HRT/params/attach inquiry) | full-spin poll, no deadline |
| 4 | asr.c:3499-3523 (`ASR_queue_i`) | `tsleep(ccb, 0, "asr", hz)` loop, no PCATCH | `I2OUSRCMD` ioctl (root) | unkillable D-state thread per wedged ioctl |

The driver's own changelog (asr.c:46-50, V1.05: "System locked up if
the Adapter locked up ... The fail outstanding command discovery loop
was flawed") establishes that transient IOP lock-ups are an expected
field condition, not an attacker fiction.

## Guest run

Trigger built on the guest (`cc 8.3`, `build.log`) and executed as root
and as user maxx: both exit(2) with `open("/dev/asr0"): No such file or
directory` — honest proof the surface is hardware-gated here
(`run.log`, `run.2.log`, `env.txt`).

## Fix

`fix.diff`:
- bounds the `ASR_resetIOP` retry loop (60 attempts),
- gives the `initOutBound` reply poll a ~3 s deadline,
- gives `ASR_queue_s` a ~30 s budget after which the ccb fails with
  `CAM_CMD_TIMEOUT` instead of spinning.

## Fix validation

`not_testable` — exercising any leg requires an IOP that stops
replying; no asr hardware on the guest.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.