# DF-3951 — Verification Verdict

**Status:** inconclusive (hardware-gated; source-certain)
**Impact demonstrated:** none (expected: permanent EBUSY lockout of all controller I/O)
**Confidence:** certain (source), runtime untestable (no DAC960 HBA)

## Source proof

1. `mlx_getslot()` increments `sc->mlx_busycmds` when handing out a slot —
   `sys/dev/raid/mlx/mlx.c:1981-1982`.
2. Sole decrement: `mlx_done()` at `mlx.c:2145-2146`, reachable only via a
   completion posted by `mlx_findcomplete()` (mlx.c:2137).
3. Wedge path: `mlx_start()` at `mlx.c:2107` clears `sc->mlx_busycmd[slot]`
   without touching `mlx_busycmds` (grep-verified: no other decrement in the
   driver). Consequence: `mlx_getslot()` at `mlx.c:1966` permanently fails
   once the leaked count reaches `limit - 4`; every subsequent
   `mlx_startio()` breaks at `mlx.c:1739-1742` → all disk I/O EBUSY, no
   recovery until reboot.
4. Secondary defect on the same path: the WEDGED command never enters
   `sc->mlx_work` (TAILQ_INSERT only on queue success, mlx.c:2094), so
   `mlx_complete()` (mlx.c:2194) never calls `mlx_unmapcmd()` for it;
   `mlx_startio()`'s wedge handler (`mlx.c:1798-1799`) calls
   `mlx_completeio()` directly → command recycled (mlx.c:1839) with
   `mc->mc_data` still bus_dmamap_load()ed (mlx_mapcmd, mlx.c:2038).

Impact: permanent controller I/O lockout (availability) — operator/root
gated ioctls or ordinary I/O against a wedged HBA; no memory-safety impact.

## Guest result

Trigger compile-tested (BUILD_RC=0, DragonFly 6.5-DEVELOPMENT); runtime
ENOENT — no Mylex hardware. Honest: inconclusive / source-certain.

## Fix validation

fix.diff adds the missing decrement. Not runtime-testable here →
fix_status: not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.