# DF-4014 — mps_user_pass_thru frees the in-flight command on wait timeout (UAF)

Source-certain (no LSI HBA on the audit guest, so no live run). See
`VERDICT.md` for the line-complete trace: mps.c:2118-2132 (no abort on
ETIMEDOUT) -> mps_user.c:977-982 -> :1039-1046 free-while-in-flight;
mpsvar.h:514-540 shows the slot returning to the free list. `fix.diff`
abandons the command instead (the driver's own config-page policy,
mps_user.c:240-245).