{
  "finding_id": "DF-4097",
  "status": "reproduced",
  "verdict": "REPRODUCED both halves: (1) XPT_RESET_DEV through the real xpt_action/production btaction path transmits an opcode-0x00 INITIATOR_CCB with cmd_len=0 sense_len=0 -- the INITIATOR_BUS_DEV_RESET stored at bt.c:1062 is clobbered by btexecuteccbs unconditional nseg==0 branch at bt.c:1285; (2) conforming firmware rejects that malformed CCB with BTSTAT_INVALID_OPCODE and production btdone panics (panic: bt9: Invalid CCB Opcode code, bt.c:1520) with backtrace captured. Device-reset error recovery is broken and admin-triggerable panic on real bt(4) hardware.",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "exploit_chain": "camcontrol reset / CAM error recovery -> xpt_action(XPT_RESET_DEV) -> production btaction stores opcode 0x81 (bt.c:1062) -> btexecuteccb(bccb,NULL,0,0) (bt.c:1070) -> nseg==0 path overwrites opcode to 0x00 (bt.c:1285) -> firmware returns BTSTAT_INVALID_OPCODE (0x16) -> btdone panic at bt.c:1520",
  "evidence": "run1_clean.log (id=0 op=0x00 cmd_len=6 vs id=1 op=0x00 cmd_len=0 sense_len=0 through the identical production path); run_panic.log + panic.txt (panic: bt9: Invalid CCB Opcode code, btdone+0x6cd backtrace)",
  "kernel_refs": [
    "sys/dev/disk/buslogic/bt.c:1062",
    "sys/dev/disk/buslogic/bt.c:1285",
    "sys/dev/disk/buslogic/bt.c:1070",
    "sys/dev/disk/buslogic/bt.c:1520"
  ],
  "poc_changes": "rig-built finding: XPT func_code constants corrected to 0x0901/0x0912 (XPT_FC_DEV_QUEUED is 0x900); queue->dispatch is asynchronous through the devq so each queue is followed by sleep+snap",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 130,
  "guest_dirty": 0,
  "build_cmd": "./push_rig.sh",
  "run_cmd": "sh run_clean.sh; (fresh boot) sh run_panic.sh",
  "code_hash": "745f8b43787e6bb6a37f62b8ac9fc1a99d7aab498a1faa6d34c8caeba4ba8651",
  "notes": "production btaction/btdone dispatched via a real registered cam_sim over a fabricated post-attach softc; the virtual firmware writes the rejection status into CCB DMA memory exactly as a MultiMaster HBA would",
  "recommended_fix": "Preserve INITIATOR_BUS_DEV_RESET across btexecuteccbs nseg==0 path (fix.diff, object-compile validated)",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "object-compile validation only (panic class, kernel A/B not mandated): patched bt.c compiles clean under -Werror with kernel headers",
  "fix_evidence": "fix.diff; FIXED-COMPILES-CLEAN with bt.fixed.o on the guest"
}