# DF-4335 — evidence pack manifest

finding_id: DF-4335
file: sys/dev/raid/twa/tw_cl_io.c
verdict: untested (kernel path requires 3ware 9000-series hardware, absent on
  the audit guest); mechanism reproduced deterministically at logic level on
  the guest using the driver's own TW_CL_Q_* list macros.
impact_class: memcorrupt (request-queue corruption -> request reuse ->
  kernel memory corruption / spinlock wedge)
severity: Medium

reproduce:
  build: "cc -O2 -Wall -o poc_dblinsert poc_dblinsert.c"
  run: "./poc_dblinsert"
  expected: |
    Case 1 ... INFINITE CYCLE ... <-- BUG
      ... SAME REQUEST CONTEXT ISSUED TO TWO OWNERS  <-- BUG
    Case 2 ... REQUEST SIMULTANEOUSLY IN BUSY_Q AND FREE_Q  <-- BUG
    Case 3 (PENDING, fixed): FREE_Q walk=4 victim_on_free=1
    Case 3 (BUSY, fixed):    victim on BUSY_Q=1 on FREE_Q=0

kernel_refs:
  - sys/dev/raid/twa/tw_cl_io.c:781-784   # get_param poll submit
  - sys/dev/raid/twa/tw_cl_io.c:804-814   # get_param out: unconditional FREE_Q insert (812-813)
  - sys/dev/raid/twa/tw_cl_io.c:899-902   # set_param poll submit
  - sys/dev/raid/twa/tw_cl_io.c:921-931   # set_param out: unconditional FREE_Q insert (929-930)
  - sys/dev/raid/twa/tw_cl_io.c:999-1006  # documented ETIMEDOUT cleanup contract
  - sys/dev/raid/twa/tw_cl_io.c:1014-1030 # helper PENDING-timeout self-cleanup (insert at 1029)
  - sys/dev/raid/twa/tw_cl_intr.c:407-416 # 1024-byte copyback into current owner's buffer
  - sys/dev/raid/twa/tw_cl_misc.c:140-170 # drain_busy_queue drops callback-less internal requests
  - sys/dev/raid/twa/tw_cl.h:270-313       # gen_lock-protected queue ops (individually)
  - sys/dev/raid/twa/tw_osl_freebsd.c:405-406 # /dev/twaN mode 0600 root:operator

artifacts:
  - README.md
  - VERDICT.md
  - poc_dblinsert.c
  - build.sh
  - run.sh
  - build.log
  - run.log
  - env.txt
  - fix.diff
  - manifest.json
  - verdict.json