{
  "finding_id": "DF-4099",
  "status": "reproduced",
  "verdict": "REPRODUCED: production btdone falls off the comp_code switch (no default, bt.c:1451; only 0x00-0x04 handled of a device-fed u8) after callout_stop already ran (bt.c:1449). Live: 3s (and permanently) after an unknown 0x42 completion the BCCB is still flags=0x1 ACTIVE on pending_ccbs, timer stopped, comp=0 callbacks, ccb_status=0x200 CAM_SIM_QUEUED -- the BCCB and the CAM command are leaked forever with no timeout to rescue them. Exhaustion run leaves 11 BCCBs permanently leaked and further commands CAM_REQUEUE_REQd (btgetccb NULL, resource_shortage, simq frozen): all I/O on the bus wedges. One honest correction: bus_dmamap_unload runs at bt.c:1403 BEFORE the switch, so the map of a data-carrying CCB is unloaded even on the fall-through; the dmamap stays loaded detail in the summary is wrong, the BCCB/command leak is real.",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "exploit_chain": "hostile/buggy HBA completes a mailbox with comp_code>=0x05 -> bt_intr_locked -> btdone: callout_stop (1449) then switch falls through with no default -> BCCB stays ACTIVE on pending_ccbs, never freed, xpt_done never called -> repeat per BCCB -> btgetccb NULL -> CAM_REQUEUE_REQ + simq freeze -> permanent I/O wedge on the bus",
  "evidence": "run.log DF-4099 section: [snap] flags=0x1 on_pending=1 timer=0 comp=0 ccb_status=0x200 at T+3s; exhaustion tail: active=11 pending=11, queue id=20 -> bccb=0x0 (REQUEUE)",
  "kernel_refs": [
    "sys/dev/disk/buslogic/bt.c:1451",
    "sys/dev/disk/buslogic/bt.c:1449",
    "sys/dev/disk/buslogic/btreg.h:466"
  ],
  "poc_changes": "queue->btaction dispatch is asynchronous through the devq, so the run sleeps+snapshots after each queue; exhaustion loop leaked 11 of 15 (rig-side EINVAL on a few iterations due to pacing), which is sufficient",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "./push_rig.sh",
  "run_cmd": "sh run1.sh",
  "code_hash": "745f8b43787e6bb6a37f62b8ac9fc1a99d7aab498a1faa6d34c8caeba4ba8651",
  "notes": "guest stayed up (non-panicking finding); rig cleaned the simq freeze at section end",
  "recommended_fix": "Add a default arm to the comp_code switch that completes the CCB with CAM_REQ_CMP_ERR (device_printf + btfreeccb + xpt_done) -- fix.diff, object-compile validated",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "object-compile validation only (leak/DoS class, kernel A/B not mandated): patched bt.c compiles clean under -Werror with kernel headers",
  "fix_evidence": "fix.diff; FIXED-COMPILES-CLEAN with bt.fixed.o on the guest"
}