# DF-3845 — OCR return-to-CAM flush vs concurrent ISR completion (no serialization)

`mrsas_reset_ctrl()`'s return-to-CAM loop (mrsas.c:2335-2343) and the ISR completion path
(`mrsas_isr` → `mrsas_complete_cmd`, mrsas.c:1200/1236, lock-free) both test `mpt_cmd->ccb_ptr`
non-atomically and both call `mrsas_cmd_done()` for the same command when an in-flight
interrupt races the reset. The only fence is a 1-second `DELAY` heuristic (mrsas.c:2327) —
`mrsas_disable_intr` does not stop an already-delivered MSI on another CPU. Result:
double `xpt_done` (CAM ccb UAF), possible `xpt_done(NULL)` panic, and double
`mrsas_release_mpt_cmd` (duplicate free-list entry → two IOs sharing one mpt cmd).
`mrsas_scsiio_timeout` (mrsas_cam.c:370) unconditionally re-arms a 600 s callout that
`callout_stop` in `mrsas_cmd_done` cannot drain, so the stale timer fires on the command's
next owner and re-triggers OCR.

## Reproduce
Race needs an attached MegaRAID HBA (completions in flight + induced fault/timeout to start
OCR). The audit guest has `mrsas` compiled in (`kldstat -v` → `80 pci/mrsas`) but no LSI PCI
device and no `/dev/mrsas*` (run.log) — the code path cannot be entered.

## Files
- `VERDICT.md` — full interleaving + aggravator analysis
- `run.log`, `env.txt` — guest presence checks
- `fix.diff` — idempotent completion (atomic cmpset claim), no 600 s re-arm, reset-loop claim
- `manifest.json`, `verdict.json`