# DF-4173 — iir(4) iir_shutdown: flush ucmd freed while in flight (+ wrong malloc type, double-queue reuse)

## Build / Run
There is **no userland trigger**: the flaw is in the
`shutdown_post_sync` event handler (`iir_shutdown`, sys/dev/raid/iir/iir.c:1478-1520)
and manifests when the controller is slow/hung at shutdown.

To document the hardware gate on the audit guest, run:

    sh gate_check.sh          # no /dev/iir, no iir PCI device, iir never attached

Expected on hardware-less guest: `no iir/isp PCI device present`.

Expected on a machine with iir hardware and a controller that fails to
complete a `GDT_FLUSH` within 10 s: the shared `ucmd` is (a) re-inserted into
`sc_ucmd_queue` for the next host drive while the previous dispatch still
owns it, and (b) unconditionally `kfree`d (with the wrong type `M_DEVBUF`)
while a pending gccb still points at it → the next `GDT_GCF_IOCTL` completion
(iir.c:1599-1633) writes `ucmd->status`, `bcopy`s up to 3 KB into the freed
`ucmd->data`, and calls `wakeup(ucmd)` → use-after-free write into freed
kernel heap.

## Fix
`fix.diff` allocates one ucmd per host drive, frees only completed ones, and
frees with the correct type (`M_GDTBUF`).