# DF-4252 VERDICT

**status: untested** (hardware-gated: no mpr HBA on the audit guest)
**impact class: dos + memory leak**
**confidence: certain** (error-path trace)

## Trace
* mpr_sas_lsi.c:142-156 — `mprsas_evt_handler` allocates fw_event + event_data.
* :170-174 — for IR_CONFIG_CHANGE_LIST with `wait_for_port_enable`,
  `mprsas_startup_increment(sassc)` (refcount +1).
* :274-457 — `mprsas_fw_work` IR case: :327-331 early `return` when
  `mpr_alloc_command` fails, skipping BOTH the :455
  `mprsas_startup_decrement(sassc)` and the :780
  `mprsas_fw_event_free(sc, fw_event)`.
* mpr_sas.c:178-226 — refcount 0 is what unfreezes the simq and completes
  startup; a stranded +1 keeps `MPRSAS_IN_STARTUP` handling pending until a
  forced drain (reinit at mpr_sas.c:941-942 or detach).

Consequences: (a) kernel memory leak per failed event, (b) discovery/
startup completion can hang, (c) leak rate correlates with command-pool
pressure (the same condition that triggers it), compounding pool
exhaustion — mps(4) twin of the DF-4015 family pattern.

Fix (fix.diff): decrement + free before the early return. Compile-validated
on the guest (build.log). fix_status: not_testable (runtime needs HBA + pool
exhaustion during an IR event).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.