# DF-3844 — blocked-cmd timeout releases mfi commands while the firmware still owns them

`mrsas_issue_blocked_cmd()` (mrsas.c:2865) and `mrsas_issue_blocked_abort_cmd()` (mrsas.c:3465)
time out after 180 s and simply return; every caller then hands the command back to the free
pool (`mrsas_release_mfi_cmd`, mrsas.c:2571) although the firmware still holds the SMID. The
late completion is routed onto the recycled command via `sync_cmd_idx`
(mrsas.c:1294-1299 → 2913), waking the wrong waiter with a stale status, and — when the
recycler is a RAID-map sync — double-releasing the command into `mrsas_mfi_cmd_list_head`
(mrsas.c:2953/2960), duplicating it on the free list so two threads later obtain the same mfi
command (endpoint: double completion / double `xpt_done`).

Most user-reachable entry: `mrsas_passthru` ioctl ignores the blocked-cmd return
(mrsas_ioctl.c:301) and releases unconditionally (mrsas_ioctl.c:367); the device node is
0660 root:operator (mrsas.c:790-792).

## Reproduce (needs hardware)
See `df3844_trigger.c` (sketch for equipped machines) and `VERDICT.md` for the full
source-level interleaving. On the audit guest this cannot run: `mrsas` is compiled into the
kernel (`kldstat -v` → `80 pci/mrsas`) but no LSI/Avago PCI device exists, so `/dev/mrsas0`
is absent (run.log).

## Files
- `VERDICT.md` — full narrative + interleaving
- `df3844_trigger.c` — trigger sketch for equipped hardware
- `run.log` — guest module/hardware presence check
- `env.txt` — guest environment
- `fix.diff` — timeout abort + per-command wait channel + ioctl return check
- `manifest.json`, `verdict.json`