{
 "finding_id": "DF-4204",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "ahci_cam_attach error paths leak the cam_sim and leave the bus registered: ahci_cam_detach no-ops because AP_F_CAM_ATTACHED is not yet set. Memory leak + stale registered CAM bus on any port whose device fails IDENTIFY at attach (hostile/misbehaving SATA device). Resource-exhaustion ceiling.",
 "verdict": "source-verified; hardware precondition (device failing IDENTIFY at attach; QEMU ide-hd always IDENTIFIES)",
 "exploit_chain": [],
 "evidence": "ahci_cam.c:137-151 error paths call detach; :211-212 detach gates ALL cleanup on AP_F_CAM_ATTACHED set only at :151",
 "kernel_refs": [
  "sys/dev/disk/ahci/ahci_cam.c:137",
  "sys/dev/disk/ahci/ahci_cam.c:211"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4204/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "widen the detach guard to cover partially-attached states (AP_F_CAM_ATTACHED|AP_F_BUS_REGISTERED, plus ap_sim==NULL)",
 "fix_evidence": "source-only"
}