{
  "finding_id": "DF-3825",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Four unbounded waits on adapter state: ASR_reset spins while (ASR_resetIOP(sc) == 0); inside crit_enter() (asr.c:1254) reachable from the asr_timeout callout and I2ORESETCMD; ASR_initOutBound busy-loops a DMAd status word with zero timeout (asr.c:1892) and is directly reachable from the I2OUSRCMD ioctl (asr.c:3211-3219); ASR_queue_s polls asr_intr with no deadline (asr.c:727) on every synchronous config path; ASR_queue_i tsleeps without PCATCH (asr.c:3499-3523). A transiently wedged IOP - a field condition the driver changelog itself documents (asr.c:46-50) - therefore hard-hangs a CPU inside a critical section or strands unkillable D-state ioctl threads. Trigger built and run on the guest as root and unprivileged: open(/dev/asr0) -> ENOENT (no I2O HBA), so the path cannot be entered; source analysis certain.",
  "exploit_chain": "wedges: adapter stops replying during asr_timeout/ASR_reset -> infinite spin in crit section -> CPU interrupts blocked -> system hang; or root I2OUSRCMD with I2O_EXEC_OUTBOUND_INIT -> ASR_initOutBound zero-timeout poll -> unkillable thread.",
  "evidence": "run.log + run.2.log (trigger ENOENT as root and user); build.log (cc 8.3 on guest); env.txt (no vendor-0x1044 PCI devices); VERDICT.md table of the four sites; fix.diff (bounded retries/deadlines)",
  "kernel_refs": [
    "sys/dev/raid/asr/asr.c:1254",
    "sys/dev/raid/asr/asr.c:1892",
    "sys/dev/raid/asr/asr.c:727",
    "sys/dev/raid/asr/asr.c:3211",
    "sys/dev/raid/asr/asr.c:3499"
  ],
  "poc_changes": "Trigger written fresh: I2OUSRCMD = _IO(D,76) per osd_unix.h, arg passed as pointer-to-pointer per asr.c:3789.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o asr_ioctl_poll asr_ioctl_poll.c",
  "run_cmd": "./asr_ioctl_poll /dev/asr0",
  "code_hash": "0d802039ae4297782f3cbea4809ae98b5436ec2a397b59c308399d66de66f75a",
  "notes": "Reset/reinit vs outstanding commands hunt item (d). Realistic availability bug for asr-equipped machines; device-lockup precondition documented by the vendor itself.",
  "recommended_fix": "Bound every polled wait: retry cap in ASR_reset, ~3s deadline in ASR_initOutBound, ~30s budget + CAM_CMD_TIMEOUT in ASR_queue_s (asr.c:727,1254,1892).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Both baseline and patched behavior require a physically present, non-responding IOP; absent on the guest. fix.diff adds the three bounds.",
  "fix_evidence": "fix.diff"
}