# DF-4308 — adwprocesserror() panics on firmware-defined host_status codes the switch does not enumerate

**File:** `sys/dev/disk/advansys/adwcam.c` — severity Low (panic/DoS),
bucket base:dev, confidence certain (source).

## Root cause

`adwprocesserror()` (adwcam.c:1341-1429) maps firmware host-status codes to
CAM statuses and ends in:

```c
	default:
		panic("%s: Unhandled Host status error %x",
		      adw_name(adw), acb->queue.host_status);   /* adwcam.c:1412-1414 */
```

`acb->queue.host_status` is a **device-written byte** (the RISC's completion
verdict, DMA'd into the acb). The switch handles every code up to 0x45
except the four codes the driver's own firmware ABI defines
(sys/dev/disk/advansys/adwlib.h:346-354):

- `QHSTA_M_DIRECTION_ERR` 0x35 — data phase mismatch (a *SCSI target* can
  deliberately violate the data-in/data-out phase agreed in the identify;
  classic malicious/misbehaving-peripheral behavior, also produced by
  marginal cabling)
- `QHSTA_M_DIRECTION_ERR_HUNG` 0x36 — same, bus hung
- `QHSTA_M_FROZEN_TIDQ` 0x46 — TID queue frozen (U160 microcode)
- `QHSTA_M_SGBACKUP_ERROR` 0x47 — S/G backup error (U160 microcode)

Any of these completing a command → `panic()` → kernel DoS from
device/target-controlled input, exactly the class DF-1548/DF-2411/DF-2415
(CALC_GEOMETRY div0) already established for this driver family, but
reachable from ordinary I/O completion rather than geometry setup.

## Reproduction

Hardware-gated: needs an Advansys HBA + a target that produces a data-phase
mismatch (or firmware emitting 0x46/0x47). Guest has no Advansys hardware
(`pciconf -l | grep 10cd` → empty). Source-level certainty — status
`untested`.

## Fix

`fix.diff` — handle the four codes (DIRECTION_ERR*→CAM_DATA_RUN_ERR,
FROZEN_TIDQ→CAM_REQUEUE_REQ, SGBACKUP_ERROR→CAM_DATA_RUN_ERR) instead of
panicking. `patch -p1` apply-verified.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.