# DF-4100 — Recovery BCCB never BCCB_ACTIVE: BDR recovery branch is dead code

## Verdict: REPRODUCED (dead branch + guaranteed hard-reset escalation)

Rig class as DF-2429 (see DF-2429/README.md).

## Build

    ./push_rig.sh

## Run

    sh run1.sh       # DF-4100 is the second section

## Expected output (run.log)

1. Production `bttimeout()` fired on a queued I/O CCB takes the BDR
   branch: `flags=0x7` (ACTIVE|DEVICE_RESET|RELEASE_SIMQ), 2s re-arm
   (`timer=1`), recovery BCCB programmed — and `rec_flags=0`
   (**BCCB_FREE**, never ACTIVE; the only writer of BCCB_ACTIVE is
   bt.c:1302 in btexecuteccb, which the recovery BCCB never transits).
2. The firmware completes the BDR mailbox (BMBI_OK) → production
   `btdone` hits the guard first — console:
   `unknown: btdone - Attempt to free non-active BCCB 0xfffff801167df690`
   (f690 == the recovery BCCB) — and returns.  `async_bdr=0`: the
   AC_SENT_BDR notification the recovery branch would send never fires;
   the pending CCB's timer stays stopped (timeouts are never
   reinstated); the SIM queue stays frozen.
3. 2s later the re-armed timer fires `bttimeout` again →
   BCCB_DEVICE_RESET set → hard-reset branch: the virtual HBA observes
   the driver write **HARD_RESET (0x80)** to CONTROL_REG
   (`vhba_hard_resets=1`, `last_ctl=128`), btreset runs to completion,
   and the timed-out CCB completes CAM_CMD_TIMEOUT (`ccb_status=0xb`).

Conclusion: targeted device recovery can never work; a single hung
command guarantees a full hard bus reset 2 seconds later, disrupting
I/O to every target on the bus.