== DF-4364 build (guest maxx, 6.5-DEVELOPMENT) ==
BUILD_EXIT=0
BUILD_FIXED_EXIT=0

== DF-4364 decisive baseline run ==
== DF-4364 harness: free-while-in-flight after mps_request_polled timeout ==

Scenario A: timed-out config cm freed, then reallocated as SCSI IO
  mps_request_polled: ETIMEDOUT after ~50s (mps.c:2153-2156); request still posted to IOC
  mps_config.c out: freed the in-flight cm (mpsvar.h:514) — SMID 0 still owned by IOC
  IOC late-completes the stale request: mps_intr_locked mps.c:1581-1600
    [late completion lands on a BUSY cm owned by another request]
    !! CROSS-REQUEST COMPLETION: SCSI IO completion callback invoked with the stale CONFIG reply frame 0xfeed0000 (reply is misparsed as MPI2_SCSI_IO_REPLY)
    !! FOREIGN FIELDS ON LIVE SCSI IO COMMAND: cm_reply=0xfeed0000 cm_reply_data=0x1050 installed by the stale CONFIG completion
    !! REPLY FOREIGN-FREE: scsiio free (request gen 2) returns slot 16 owned by request gen 1 (reply FIFO accounting corrupted)
  >>> VIOLATIONS CONFIRMED (cross-request completion: 1, reply accounting corruption: 1, foreign/UAF writes: 1)

Scenario B: timed-out config cm freed, still FREE at late completion
  IOC late-completes the stale request onto the cm
    [late completion lands on a FREE cm]
    !! STALE FIELDS ON FREE OBJECT: FREE cm now carries cm_reply=0xfeed0000 cm_reply_data=0x1050
    !! reply slot 16 is now DOUBLE-BOOKED: next mps_alloc_command() hands this cm out; if the new request finishes via the SCSI_IO_SUCCESS path (cm_reply=NULLed, mps.c:1516) the slot is leaked -> reply queue exhaustion; if via free_command it is double-freed

== verdict: 2 scenario(s) with kernel-invariant violations ==
RUN_EXIT=1

== DF-4364 fixed-validation run ==
== DF-4364 harness: free-while-in-flight after mps_request_polled timeout ==

Scenario A: timed-out config cm freed, then reallocated as SCSI IO
  mps_request_polled: ETIMEDOUT after ~50s (mps.c:2153-2156); request still posted to IOC
  [FIXED] reinit-on-timeout, then free: safe
  IOC late-completes the stale request: mps_intr_locked mps.c:1581-1600
  invariants hold

Scenario B: timed-out config cm freed, still FREE at late completion
  IOC late-completes the stale request onto the cm
  invariants hold

== verdict: 0 scenario(s) with kernel-invariant violations ==
FIXED mode: reinit-on-timeout (mpr-style) prevents the UAF
FIXED_EXIT=0