# DF-4254 VERDICT

**status: untested** (hardware-gated: no mpr HBA on the audit guest)
**impact: logic/data-integrity (disk lockout + wrong shutdown handling)**
**confidence: certain** (single-token defect, mps twin already acknowledged as DF-1698)

## Trace
mpr_sas_lsi.c:590-606: PD-state OFFLINE branch intends to expose a former
RAID component to the OS by clearing MPR_TARGET_FLAGS_RAID_COMPONENT, but
:598-599 uses `|=` with the *inverted* mask — all bits except
RAID_COMPONENT get set and RAID_COMPONENT remains set. Consequences:

1. Disk lockout: `mprsas_add_device` (:909) special-cases targets whose
   RAID_COMPONENT bit is set (skips ID/reuse validation), and rescan paths
   treat it as still-owned by the volume — the freshly-exposed phys disk
   never becomes usable (same user-visible effect the mps twin DF-1698
   describes: "locking disk out of OS permanently").
2. Wrong SSU classification: MPR_TARGET_IS_SATA_SSD is force-set;
   `mprsas_ir_shutdown` (:1677-1698) maps SSD flag → stop_at_shutdown =
   FALSE for the enable-HDD profiles — spinning HDDs are not stopped at
   shutdown, defeating the spin-down-before-power-off protection the whole
   SSU machinery exists for (potential data loss on power cut).

mps twin: DF-1698 (mps_sas_lsi.c) — identical upstream FreeBSD code, same
fix applied there. No mpr-side finding existed (knowns were DF-1473/1474/
1475 only), so this is filed for the mpr driver.

Fix: `&= ~` (fix.diff, compile-validated in build.log). fix_status:
not_testable (runtime needs IR-mode HBA + phys-disk state event).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.