{
 "finding_id": "DF-4078",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "none",
 "confidence": "likely",
 "verdict": "Source-level likely, chip-gated permanent hangs. (1) mps_wait_command():2129 does lksleep(cm, ..., timeout*hz); mps_read_config_page() passes timeout == 0 at :2221 => indefinite sleep. A silent-but-not-faulted IOC (periodic watchdog only calls mps_reinit on MPI2_IOC_STATE_FAULT) hangs the config-path thread forever. (2) mps_reinit():353 ignores the return of mps_reregister_events(); if it fails (EBUSY from an exhausted command pool, or bus_dmamap_load error), the completion that would call mpssas_startup() never fires, so the simq frozen in mpssas_handle_reinit (mps_sas.c:1091) is never released => all adapter I/O wedged until reboot. (3) mps_reregister_events():1769-1772 treats mps_map_command() EINPROGRESS as a failure although the async map callback will still enqueue and complete the request, needlessly entering that failure path.",
 "exploit_chain": "",
 "evidence": "mps.c:2129 lksleep with timeout*hz; :2221 caller passes 0; :353 unchecked mps_reregister_events(); mps_sas.c:1091 xpt_freeze_simq",
 "kernel_refs": [
  "sys/dev/raid/mps/mps.c:2129",
  "sys/dev/raid/mps/mps.c:2221",
  "sys/dev/raid/mps/mps.c:353",
  "sys/dev/raid/mps/mps_sas.c:1091"
 ],
 "poc_changes": "n/a (source-level)",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "n/a (source-level finding)",
 "run_cmd": "n/a (hardware-gated; source-level analysis)",
 "code_hash": null,
 "notes": "DoS-only (hang); no memory corruption.",
 "recommended_fix": "Pass a finite timeout at :2221; check and act on mps_reregister_events() failure (retry or fail the reinit); treat EINPROGRESS as success in mps_reregister_events().",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
 "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}