# VERDICT — DF-4214

**status: untested (hardware-gated) · impact: request leak → unkillable hang on surviving controller (dos) · confidence: certain (source)**

Not runnable here: requires ≥2 LSI MPT Fusion HBAs (`env.txt` shows none).
Mechanism proven from source:

- Global handler table + idempotent register: `mpt.c:119`, `mpt.c:417-426`.
- Un-refcounted deregister: `mpt.c:466-471`.
- `mpt_raid.c:135` static `raid_handler_id`; attach register at
  `mpt_raid.c:291-293`; detach deregister at `mpt_raid.c:338-340` — with two
  controllers attached, the first detach clears the shared slot.
- Surviving controller's RAID actions encode that handler id
  (`mpt_raid.c:616`); after the slot is cleared, `mpt_intr` dispatches to
  `mpt_default_reply_handler` (`mpt.c:809-821` → `mpt.c:480-495`) which
  never completes/frees the request → ETIMEDOUT after the 2 s busy poll
  (`mpt.c:1356-1361`) → leaked requests pinned on `request_pending_list`
  (`mpt_verify_mwce` `mpt_raid.c:977-981` leaves them), pool exhaustion, and
  `mpt_get_request` sleeping forever (`mpt.c:1273-1276`) — wedging the RAID
  thread and sysctl writers in non-interruptible sleep.

Severity Low (unusual configuration: two RAID cards + detaching one). Fix
diff refcounts the registration; not runtime-validated (no hardware) →
`fix_status: not_testable`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.