{
  "finding_id": "DF-3894",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "mpssas_action_resetdev allocates its XPT_RESET_DEV task-management command from the normal pool (mps_alloc_command pops sc->req_list, mps_sas.c:2765, mpsvar.h:543-555) but mpssas_resetdev_complete frees it via mpssas_free_tm (mps_sas.c:2832), which pushes it onto sc->high_priority_req_list (mpsvar.h:576) and decrements sc->sassc->tm_count (mps_sas.c:262) that this path never incremented \u2014 tm_count (u_int, mps_sas.h:100) underflows 0\u21920xFFFFFFFF, permanently disabling the 0\u21921 xpt_freeze_simq transition in mpssas_alloc_tm (mps_sas.c:242) and violating the documented stop sending commands during task management invariant (mps_sas.c:231-234). Each XPT_RESET_DEV (CAM error recovery or camcontrol reset) permanently leaks one SMID from the normal pool and injects a normal-pool SMID into the high-priority pool (seeded at init only with SMIDs <= facts->HighPriorityCredit, mps.c:864-867); repetition exhausts the normal pool (adapter-wide CAM_RESRC_UNAVAIL) and can hand a TM an out-of-credit SMID. Exact twin of DF-1223 (mpr_sas.c). Not reproduced: no SAS2 HBA in the guest, SIM never attaches; mismatch is certain from source.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line proof of both pool mismatch and tm_count underflow), env.txt, run.sh + run.log (hardware gate), fix.diff (mpssas_alloc_tm + memset req)",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_sas.c:2765",
    "sys/dev/raid/mps/mps_sas.c:2832",
    "sys/dev/raid/mps/mps_sas.c:262",
    "sys/dev/raid/mps/mps_sas.c:269",
    "sys/dev/raid/mps/mps_sas.c:242",
    "sys/dev/raid/mps/mpsvar.h:543",
    "sys/dev/raid/mps/mpsvar.h:558",
    "sys/dev/raid/mps/mps.c:864"
  ],
  "poc_changes": "Trigger is any XPT_RESET_DEV on real mps hardware; run.sh records the hardware gate.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "sh findings/poc/DF-3894/run.sh",
  "code_hash": "",
  "notes": "Same defect in upstream FreeBSD mps(4). Twin of DF-1223 (mpr). Also notes: mpssas_action_resetdev is the only TM sender that does not zero its request frame (contrast mps_sas.c:513, 579).",
  "recommended_fix": "Allocate the XPT_RESET_DEV TM with mpssas_alloc_tm() so alloc/free pools and tm_count/freeze accounting balance; memset the request frame.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff restores pool/refcount symmetry; cannot be exercised on this guest (no SAS2 HBA).",
  "fix_evidence": "findings/poc/DF-3894/fix.diff"
}