# VERDICT — DF-3833

**status: inconclusive (speculative, hardware-gated)** — reproduced: 0 — guest impact: none.

## Window analysis
1. **trm_Interrupt BUSSERVICE/CMDDONE path** (trm.c:1337-1350). `pACB->pActiveDCB` is:
   - cleared at trm.c:2359 in `trm_Disconnect` (every disconnect, before `trm_DoWaitingSRB`
     starts the next command);
   - cleared at trm.c:1185 in `trm_reset` **after** `trm_DoingSRB_Done` freed all going SRBs and
     **after** interrupts were re-enabled at trm.c:1176-1178 (EN_SCSIINTR at 3369 keeps
     bus-service interrupts on);
   - cleared at trm.c:2805 in `trm_ScsiRstDetect` (external reset).
   In any of these windows an INT_BUSSERVICE/INT_CMDDONE from the aborted command reaches
   `pSRB = pDCB->pActiveSRB` with `pDCB == NULL`: on X86_64_GENERIC (KASSERT compiled out,
   sys/sys/systm.h:117) that is a NULL-page read → panic; on INVARIANTS the KASSERT itself
   panics. Note `pDCB->pActiveSRB` is *also* never NULL-checked even when pDCB is valid —
   `pActiveSRB` is NULL between `disc1` (trm.c:2402) and the next start.
2. **trm_SRBdone unlink walk** (trm.c:2718-2729). `while (psrb->pNextSRB != pSRB)` assumes the
   SRB is on the going list. `trm_RecoverSRB` (trm.c:1141-1160) moves *all* going SRBs of every
   DCB to their waiting lists on external-reset detection — but leaves `pDCB->pActiveSRB`
   pointing at the (now waiting-list) SRB. A subsequent stale completion routed through
   `trm_Disconnect` → `disc1` → `trm_SRBdone` (trm.c:2397-2404) then walks past the emptied
   list and derefs `psrb->pNextSRB` with `psrb == NULL`.

Sibling of known DF-2524 (trm_Disconnect's own pActiveSRB deref) — this finding covers the two
other members of the same stale-completion family that pass 1 did not file.

## Why not reproduced
No Tekram adapter on the audit guest (env.txt); the trigger additionally requires chip-level
timing (stale interrupt between reset recovery and next selection). Confidence: speculative
(reachability timing-dependent), the missing checks are certain in source.

## Fix
fix.diff: drop stale BUSSERVICE/CMDDONE interrupts when `pActiveDCB`/`pActiveSRB` is NULL, and
make the going-list walk terminating (`psrb != NULL` guard + skip-unlink path).
`git apply --check` passes.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.