# DF-4063 — fdformat() timeout → double biodone + pbuf recycle under the driver

`sys/dev/disk/fd/fd.c` `fdformat()`: a 20 s `biowait_timeout` on the format bio
is treated as completion — `fdformat()` calls `biodone()` on a bio the fdc
state machine still owns and `relpbuf()`s the pbuf under it. With the shared
controller queue stalled >20 s by concurrent I/O (no hardware fault needed),
the freed pbuf is recycled by the next `getpbuf()` (e.g. a second FD_FORMAT),
the same bio gets TAILQ-linked twice in `fdc->bio_queue`, and the next dequeue
panics the kernel: `panic: Bad link elm ... next->prev != elm` in `fdstate()`.

Reachable by root (FD_FORM needs a write open on /dev/fd*, 0640 root:operator;
typed nodes 0600 root:wheel). Reproduced deterministically (2/2 panics) on the
audit QEMU guest with an ISA floppy attached; fix (plain `biowait`) built and
validated in-guest — no early return, no panic.

## Reproduce

1. Guest kernel must contain `device fdc0 at isa? port IO_FD1 irq 6 drq 2` +
   `device fd0` (stock GENERIC omits it; the evidence pack's env.txt records
   the config lines used) and QEMU must attach the fdc:
   `-device floppy,drive=fd0 -drive id=fd0,if=none,file=floppy.img,format=raw`
   (temp launcher `dfbsd-qemu/run_fdtest.sh`, vm.sh untouched).
2. `./build.sh`  → cc -O2 -pthread -o /tmp/fd_timeout_uaf fd_timeout_uaf.c
3. As root: `/tmp/fd_timeout_uaf 128`
4. Expected (unpatched): fdform#1 → EIO at ~20 s while 128 readers keep the
   queue deep; kernel panics ≈1 min later with `Bad link elm` (fdstate).
   Expected (patched): both FD_FORMs return 0 after the real drain (~37 s),
   no panic.