# VERDICT — DF-3830

**status: inconclusive (source-certain, hardware-gated)** — reproduced: 0 — impact demonstrated on guest: none
(confirmed impact class on hardware: UAF/panic/wedge; not exercised — no Tekram HBA on the audit guest, env.txt).

## Why this is a real defect (line-cited trace)

`trm_detach` (sys/dev/disk/trm/trm.c:3692-3716) executes, in this order:

| step | line | operation | consequence |
|---|---|---|---|
| 1 | 3696 | `bus_release_resource(dev, SYS_RES_IOPORT, PCIR_BAR(0), pACB->iores)` | chip registers unmapped while IRQ still live (teardown at 3710) → ISR (trm_Interrupt, trm.c:1300-1352) touches a released bus space |
| 2 | 3697 | `trm_destroySRB(pACB)` | walks **only** `pACB->pFreeSRB` (trm.c:3003-3014) — SRBs on `pDCB->pWaitingSRB`, `pDCB->pGoingSRB`, `pDCB->pActiveSRB` keep live `sg_dmamap`/`dmamap` |
| 3 | 3698-3709 | destroy `sg_dmat`, free **the whole SRB array** (`bus_dmamem_free(srb_dmat, pACB->pFreeSRB, …)`, 3700), free sense buffers, destroy `buffer_dmat` | every in-flight CCB's `ccb_h.ccb_trmsrb_ptr` (set at trm.c:588) now dangles; their `pccb`s are **never xpt_done'd** (no drain anywhere) → CAM wedge + UAF on next touch |
| 4 | 3710 | `bus_teardown_intr(dev, pACB->irq, pACB->ih)` | the ISR could still be running against steps 1-3 state |
| 5 | 3712-3715 | `xpt_async(AC_LOST_DEVICE)`, `xpt_free_path`, `xpt_bus_deregister`, `cam_sim_free` | the SIM that calls `trm_action`/`trm_poll` into the freed softc is only deregistered **last** |

There is no `xpt_freeze_simq`, no drain of going/waiting SRBs, no completion of outstanding CCBs —
compare FreeBSD's later trm(4), and the driver's own attach-failure path which never has the
SIM registered while freeing (trm.c:3631-3665).

## Reachability
- `trm` is not in X86_64_GENERIC; it is a KLD (`sys/dev/disk/trm/Makefile`). Trigger: root
  `kldunload trm.ko` with I/O in flight, or surprise hot-removal of the PCI card.
- Root-only / physical → severity Low, but the primitive is a straight UAF of the 128 KiB SRB array
  (`TRM_MAX_SRB_CNT * sizeof(TRM_SRB)`, trm.c:3441-3456) plus unmapped-MMIO ISR execution.
- Guest: `pciconf -l` shows 7 devices, none with vendor 0x1DE1 (env.txt) → `trm_probe`
  (trm.c:3677-3688) returns ENXIO, driver never attaches, `trm_detach` unreachable. Hence
  inconclusive rather than reproduced.

## Fix validation
fix.diff reorders detach into: flush+deregister SIM → teardown IRQ → free SRB DMA → free sense →
destroy tags → release I/O port, and drains going/waiting lists (complete with CAM_UNEXP_BUSFREE,
recycle SRB) before freeing the array. Not exercisable on this guest (no hardware);
compiles-by-inspection against the current tree only.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.