df43xx[5b]: recycled-slot variant - duplicated entry names a slot whose ccb_info was recycled onto a LIVE transaction (cinfo->ccb now the new ccb, dmamap loaded)
df43xx-b: regpage ok
df43xx-b: softc ok
df43xx-b: bus_dma_tag ok
df43xx-b: ccb_infos alloc ok
df43xx-b: sense ok
df43xx-b: slot 0 dmamap_create...
df43xx-b: slot 0 dmamap ok, ccb+callout kmalloc...
df43xx-b: slot 0 callout_init...
df43xx-b: slot 0 callout ok
df43xx: softc=0xfffff8004f271cd0 regpage=0xfffff8004f0a3370 ccb_infos=0xfffff80117d5f200 (sz 512) nactive=1 nallocated=1 groom=0 sz(adv_ccb_info)=32 sz(adv_softc)=240 off(csio.resid)=276 off(ccb_info.ccb)=16
df43xx[5b]: after #1: slot0 FREE; recycling slot0 for a new transaction and loading a LIVE data buffer:
df43xx[5b]: LIVE mapping present (bpages=0)
df43xx[5b]: duplicated entry -> production adv_done on the LIVE recycled ccb D:
df43xx[5b]: after: D timeout pending=0 (armed->stopped: YES), dmamap bpages=0 (LIVE mapping UNLOADED while the hardware transaction is still in flight: YES), slot0.state=0x00 (slot handed back to free list with hardware still executing), D.ccb_cinfo_ptr=0, D.status=0x00000001 - when the firmware later completes this queue for real, adv_done runs on freed/CAM-owned memory (double xpt_done UAF family)
df43xx-b: regpage ok
df43xx-b: softc ok
df43xx-b: bus_dma_tag ok
df43xx-b: ccb_infos alloc ok
df43xx-b: sense ok
df43xx-b: slot 0 dmamap_create...
df43xx-b: slot 0 dmamap ok, ccb+callout kmalloc...
df43xx-b: slot 0 callout_init...
df43xx-b: slot 0 callout ok
df43xx-b: slot 1 dmamap_create...
df43xx-b: slot 1 dmamap ok, ccb+callout kmalloc...
df43xx-b: slot 1 callout_init...
df43xx-b: slot 1 callout ok
df43xx-b: slot 2 dmamap_create...
df43xx-b: slot 2 dmamap ok, ccb+callout kmalloc...
df43xx-b: slot 2 callout_init...
df43xx-b: slot 2 callout ok
df43xx: softc=0xfffff8004f271cd0 regpage=0xfffff8004f0a3370 ccb_infos=0xfffff80117d5f200 (sz 512) nactive=3 nallocated=3 groom=0 sz(adv_ccb_info)=32 sz(adv_softc)=240 off(csio.resid)=276 off(ccb_info.ccb)=16
df43xx[5a]: initial pending list (head->tail):
df43xx[5a]: pending_ccbs: 0xfffff8008db1d7c0 0xfffff8008db1dac0
df43xx[5a]: A timeout armed=1
df43xx[5a]: completion #1 (production adv_done on A, as adv_run_doneq:1109 does for a legit entry):
df43xx[5a]: after #1: slot0.state=0x00 free.slh_first=0xfffff80117d5f200 A.ccb_cinfo_ptr=0 A timeout pending=0 list:
df43xx[5a]: pending_ccbs: 0xfffff8008db1dac0
df43xx[5a]: new LIVE ccb D=0xfffff8008db1f8c0 queued at head; list:
df43xx[5a]: pending_ccbs: 0xfffff8008db1f8c0 0xfffff8008db1dac0
df43xx[5a]: completion #2 (production adv_done on the STALE A - exactly what a duplicated done entry drives):
panic: Bad link elm 0xfffff8008db1d7c0 next->prev != elm
cpuid = 0
Trace beginning at frame 0xfffff801182776a8
adv_intr() at adv_intr 0xffffffff802e68f0 
adv_intr() at adv_intr 0xffffffff802e68f0 
df43xx_go_sysctl() at df43xx_go_sysctl+0xf92 0xffffffff82601b62 
sysctl_root.isra.5() at sysctl_root.isra.5+0x166 0xffffffff80683d06 
userland_sysctl() at userland_sysctl+0x111 0xffffffff806840a1 
sys___sysctl() at sys___sysctl+0x74 0xffffffff80684204 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>