{
  "finding_id": "DF-4336",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "tw_cl_reset_ctlr (tw_cl_io.c:1049-1130) has no entry guard: it sets reset_in_progress (1060) but no caller checks it, and reset_needed is cleared only at completion (1124). The MPSAFE watchdog callout (tw_osl_freebsd.c:469-477) and any number of passthru-timeout ioctl threads (tw_osl_freebsd.c:1005-1011) can therefore execute the full reset state machine concurrently on a controller whose firmware wedged or whose queue saturated past request deadlines: two soft resets race the single phase-1 firmware notification (60s loops), interleave init_connection credit renegotiation, interleave RESET_Q->PENDING requeues with each others drains, and the first finisher re-opens the submission gate (reset_in_progress=FALSE at 1123) while the second reset is still running \u2014 feeding new commands into an active reset and self-sustaining a reset storm. Kernel path untestable on this guest (no twa hardware). Individual queue ops are gen_lock-serialized, so no deterministic kernel memory corruption was derivable; realistic ceiling is controller I/O wedge (DoS). Filed Low.",
  "exploit_chain": "",
  "evidence": "VERDICT.md code trace with path:line for both unserialized callers and the interleaving points",
  "kernel_refs": [
    "sys/dev/raid/twa/tw_cl_io.c:1060",
    "sys/dev/raid/twa/tw_cl_io.c:1123",
    "sys/dev/raid/twa/tw_cl_io.c:1208",
    "sys/dev/raid/twa/tw_osl_freebsd.c:469",
    "sys/dev/raid/twa/tw_osl_freebsd.c:1005"
  ],
  "poc_changes": "no PoC authored: no software-only entry path exists without a 3ware 9000-series controller",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "none",
  "notes": "Device 0600 root:operator; trigger also reachable via ordinary CAM I/O pressure making an OSL request miss its deadline (watchdog path needs no ioctl).",
  "recommended_fix": "Make tw_cl_reset_ctlr test-and-set reset_in_progress under gen_lock and return EBUSY to losers; latch reset_needed at reset start so concurrent watchdog ticks re-arm the next reset instead of recursing.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Kernel fix validation impossible on this guest (no twa hardware).",
  "fix_evidence": "n/a"
}