# DF-4044 — amdparsemsg MSG_DISCONNECT writes through NULL active_srb after an unexpected reselection

**File:** sys/dev/disk/amd/amd.c
**Severity:** Medium  |  **Class:** CWE-476 NULL Pointer Dereference
**Status:** hardware-gated — source-certain; runtime reproduction impossible on the audit guest
(no AMD53C974 HBA — see env.txt). Verdict: `inconclusive`, confidence `certain`.

## Build & run (on the DragonFly guest)

    ./build.sh     # compiles the demonstrator (verbatim-copy of the driver walks)
    ./run.sh       # reproduces the exact branch selection / fault

Expected: the `DF-4044` section of run.log shows the panic-branch selection / fault.
Full guest details in env.txt.

## Fix validation

fix.diff applied (with all DF-4036..DF-4044 patches together) to a clean guest /usr/src copy;
`make nativekernel KERNCONF=X86_64_GENERIC` completed with 0 errors under -Werror
(see fix_build.log — amd.o recompiled into the GENERIC kernel).
Sources restored to pristine afterwards (md5-verified).