# DF-4243 — send-failure path in dptexecuteccb leaves the timeout callout armed

dptexecuteccb arms the CCB timeout (callout_reset, dpt_scsi.c:778) *before*
handing the command to the controller. If dpt_send_eata_command() then fails
(HBA stays HA_ABUSY for ~1s: wedged/faulty controller), the error path at
dpt_scsi.c:780-788 unloads the map, frees the dccb and xpt_done()s the ccb —
but never callout_stop()s the armed timer (compare the normal completion
path, which does: dpt_scsi.c:1572).

When the stale callout later fires, dpttimeout() runs on a freed/possibly
recycled state:
  * dccb->ccb is stale → xpt_print_path(ccb->ccb_h.path) reads a possibly
    recycled CAM ccb (dpt_scsi.c:1683-1685);
  * if the dccb was already re-allocated to a new command, the
    `DCCB_ACTIVE` check passes and dpttimeout sends EATA_SPECIFIC_ABORT
    (dpt_scsi.c:1707) against the *new, healthy* command and stamps
    CAM_CMD_TIMEOUT on its ccb — premature abort of unrelated I/O.