=== DF-4042 MESSAGE REJECT while msgout=[MSG_ABORT] or [MSG_NOOP] -> panic(:1435) ===
  msgout_buf[0]=0x06 len=1: walk hits the unhandled-byte else at :1434 -> PANIC 'amdsentmsg: Inconsistent msg buffer' (found=0)
  msgout_buf[0]=0x08 len=1: walk hits the unhandled-byte else at :1434 -> PANIC 'amdsentmsg: Inconsistent msg buffer' (found=0)
  contrast: msgout=[EXT,3,SDTR,p,o] (SDTR pending) -> found=TRUE, reject handled, no panic:
    amdsentmsg returns found=1, no panic branch

=== DF-4043 MESSAGE REJECT of a tagged command -> amdsettags(:846) panic('Implement me!') ===
  tagged selection, msgout_len=0: amdsentmsg found=0 -> handlemsgreject falls to :1475 tag branch
  :1485 amdsettags(amd,0,FALSE) -> amd.c:846 panic("Implement me!")  [kernel panic; xpt_alloc_ccb at :1483 also leaks]
  reachable whenever tag queuing is enabled (EEPROM default: TAG_QUEUING bit, amd_load_defaults:2238) and the target rejects the tag msg

=== DF-4044 MSG_DISCONNECT byte after unexpected reselection (active_srb==NULL) -> :1218 NULL write ===
  child took signal 11 on active_srb->SRBState with active_srb=0x0 — kernel equivalent: NULL-page write fault in amd_intr context => panic

=== KILLS: walks checked and found bounded ===
  (1) amd_MsgInPhase0:1188 msgin_buf[4] max index reached = 4 < 6 — bounded (EXT len is fixed MSG_EXT_SDTR_LEN=3)
  (2) parsemsg:1228 SRB_array[msgin_buf[1]]: tag byte 0..255 vs MAX_SRB_CNT=256 entries — fits exactly, no OOB (checked state+lun guard at :1230-1232)
  (3) handlemsgreject:1498 bcopy(&buf[0],&buf[1],len) with len<=5 -> writes buf[1..5] of msgout_buf[6] — fits
  (4) amdtimeout/amd_reset and the callout_reset at amd.c:356-360 are all #if 0 — no timeout-vs-intr race exists in this driver
  (5) amd_ReadEEprom:2221 writes 64 words = 128B into eepromBuf[128] — exact fit; checksum loop :2254 walks 64 words — exact fit (EE_SPEED known DF-1349)
  (6) XPT_RESET_BUS:495-505 zeroing ACBFlag before the reset IRQ handler observes RESET_DEV can strand queued CCBs (hang, not corruption) — logged, not filed

DEMONSTRATOR COMPLETE.