# DF-3965 verdict — certain lifetime bug, Low on this platform

## Reproduced?
No HBA on the guest (env.txt).

## Analysis
- Load: hptiop.c:2304-2309 (every data CCB).
- Unload only-on-success: hptiop.c:393-409 (itl), 547-561 (mv), 654-668
  (mvfrey) — the `switch (result)` puts sync/unload inside the SUCCESS arm;
  BAD_TARGET/BUSY/INVALID/FAIL/RESET/CHECK_CONDITION fall through to
  `hptiop_free_srb` (457/599/706) with the map loaded.
- BAD_TARGET is generated by ordinary bus probes (absent tids) — CAM scans at
  attach (hptiop_rescan_bus, 2067) and via the HPT_SCAN_BUS ioctl (219-221),
  so the leak is deterministic, not exceptional.
- DragonFly amd64 busdma (sys/platform/pc64/x86_64/busdma_machdep.c:616-677):
  bounce reservation state (`map->pagesneeded`) is only cleared by
  bus_dmamap_unload; re-loading a loaded map with pagesneeded!=0 skips the
  recount and layers reservations. With the current io_dmat (lowaddr =
  BUS_SPACE_MAXADDR) pagesneeded stays 0 on amd64 → bookkeeping-only today,
  but the driver's own srb_dmat/ctlcfg use 32-bit lowaddrs and other
  platforms/configs bounce for real.

## Fix
fix.diff hoists the direction sync/unload in front of the result switch in
ALL THREE callbacks (itl :393, mv :547, mvfrey :654) so the map is released
on every completion. Verified to compile: hptiop.ko builds clean with
-Werror on the guest /usr/src (build.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.