# VERDICT — DF-4401

**Status: inconclusive (hardware-gated).** The check-then-act race is certain
from source; triggering needs the 3ware controller to be distressed enough that
two reset callers overlap.

## Proof chain

1. `tws_reset` entry guard is a plain read: `tws_cam.c:1203-1205`
   `if (tws_get_state(sc) == TWS_RESET) return;` — no lock held; the state
   transition happens later under `gen_lock` at `:1207-1209`.
2. `tws_send_event(TWS_RESET_START)` asserts single-entry:
   `tws.c:664-671` `KASSERT(sc->tws_state != TWS_RESET, ...)`; `KASSERT` panics
   only on INVARIANTS kernels (`sys/sys/systm.h:94-122`).
3. Concurrent callers:
   - ccb timeout callout per I/O: `tws_cam.c:807-808` arms
     `tws_timeout`, which calls `tws_reset` (`:1191-1194`) for every timed-out
     request;
   - controller-error interrupt: `tws_intr_attn_error` → `tws_reset`
     (`:1143-1153`);
   - passthrough ioctl timeout: `tws_user.c:142-147` → `tws_reset` while
     holding `gen_lock` (recursive; `tws.c:199`).
   Nothing serializes them before the state check.
4. Production-kernel consequence of a double entry:
   - `xpt_freeze_simq(sc->sim, 1)` executed twice (`tws_cam.c:1212-1214`) vs a
     single `xpt_release_simq(sc->sim, 1)` in `tws_reinit` (`:1268-1270`):
     `sendq.qfrozen_cnt` is a counter (`sys/bus/cam/cam_xpt.c:4863-4865`), so a
     leaked increment keeps the devq frozen permanently → every subsequent
     `tws_execute_scsi` sees a frozen SIM; disk I/O on the adapter never
     resumes.
   - duplicated `tws_assert_soft_reset` (`:1216`) and callout chains
     (`:1217`, `:1238`) → duplicated reinit sequences.
5. Multi-adapter defect: `tws_reinit`'s `static int timeout_val=0, try=2`
   (`:1246`) is shared by every controller instance.

## Impact ceiling
Panic (INVARIANTS) or permanent adapter-wide I/O hang (production) — a local
denial of service; no info leak or privilege path. Rated Low consistent with
DF-4336.

## Fix
Serialize `tws_reset` entry under `gen_lock` with a re-check after acquisition
(fix.diff), and move `tws_reinit`'s retry counters into the softc.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.