{
  "finding_id": "DF-3831",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "trm(4) never arms the CAM CCB timeout: the callout_reset for ccb_h.timeout_ch is inside #if 0 /* XXX Need a timeout handler */ (sys/dev/disk/trm/trm.c:470-474) and no trm_timeout function exists in the tree. A command accepted by a target but never completed (mid-transfer stall, unplugged disk, hostile target emulator - the selection-timeout logic at trm.c:1217-1229 only covers selection, not mid-phase stalls) therefore wedges the single-command-per-target SIM queue forever with no recovery short of reboot. Aggravator: trm_ExecuteSRB ignores the bus_dmamap callback error argument (trm.c:414), so a failed bus_dmamap_load (e.g. EFBIG for >TRM_NSEG=btoc(MAXPHYS)+1 segment pass(4) buffers, trm.h:98) orphans the CCB with no xpt_done - and with no timeout there is no path that ever completes it. Source-certain; hardware-gated (no Tekram PCI device on the audit guest, env.txt), hence inconclusive rather than reproduced.",
  "exploit_chain": "any local I/O through a trm(4) disk whose target hangs mid-phase -> CCB never times out -> SIM queue frozen permanently -> all I/O to that bus wedges (local DoS). No privilege gain.",
  "evidence": "VERDICT.md (trace of the #if 0 block and the ignored error arg); env.txt; fix.diff (arm/stop callout + trm_timeout + error check, git-apply --check passes)",
  "kernel_refs": [
    "sys/dev/disk/trm/trm.c:470",
    "sys/dev/disk/trm/trm.c:414",
    "sys/dev/disk/trm/trm.c:1217",
    "sys/dev/disk/trm/trm.h:98",
    "sys/dev/disk/trm/trm.c:2477"
  ],
  "poc_changes": "No runnable PoC without the PCI card; pack is analysis + fix only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Pass-2 hunt item (b) timeout/reset paths vs the ISR (callout discipline family). Driver is module-only; impact is operational DoS requiring a hung target.",
  "recommended_fix": "Arm ccb_h.timeout_ch in trm_ExecuteSRB, stop it in trm_SRBdone, add trm_timeout (bus reset), and fail the CCB when the dmamap callback reports error (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Both baseline and patched runs need an attached Tekram adapter with a hangable target; absent on the audit guest. fix.diff is git-apply-able (verified).",
  "fix_evidence": "fix.diff"
}