# VERDICT — DF-4403

**Status: inconclusive (hardware-gated).**

## Proof (per path)

1. **Reserved-slot lifecycle.** `tws_get_request()` marks slots 0-3 BUSY by
   `state` only (`tws.c:749-789`); only slots ≥ `TWS_RESERVED_REQS` ever live
   on FREE_Q (`tws.c:631-632`). A reserved slot is freed by setting
   `state = TWS_REQ_STATE_FREE` (e.g. `tws_getset_param_complete`,
   `tws_cam.c:392-394`). If an allocation between get and submit fails, none
   of those completion paths runs:
   - `tws_send_scsi_cmd` `tws_cam.c:842-844` → `reqs[1]` (AEN) stuck BUSY;
   - `tws_set_param` `:870-872` and `tws_get_param` `:919-921` → `reqs[3]
     (GETSET_PARAM) stuck BUSY (get_param additionally has `cb == NULL`,
     `:924`, so even a spurious firmware response can never complete it).
   Every future `tws_get_request(type)` for that type returns NULL
   (`tws.c:763-764`) — the channel is dead for the life of the adapter.
   AEN death specifically silences `tws_aen_complete` → `tws_fetch_aen`
   re-arm (`tws_cam.c:472-476`), i.e. array event delivery stops silently.
2. **SCSI IO slot + ccb.** `tws_execute_scsi` removes a request from FREE_Q at
   `:719` (`tws.c:792-794`) and arms the ccb callout at `:807`. If
   `tws_map_request` fails (`:809` — `bus_dmamap_load` ENOMEM; the
   EINPROGRESS case is converted at `:995-999` and is fine), the function
   returns the error; `tws_action` only traces (`:271-272`). The ccb has
   `CAM_SIM_QUEUED` set (`:717`) and is never `xpt_done`d; the request is on
   no queue (BUSY_Q insertion happens only in `tws_submit_command`,
   `tws_hdm.c:326-330`, never reached), so `tws_drain_busy_queue`
   (`tws_cam.c:616-643`) cannot rescue it during a reset either. The upper
   layer waits forever; the armed callout (`:807`) fires `tws_timeout` →
   `tws_reset` → adapter-wide disruption — for a software allocation failure.

## Trigger
Kernel memory pressure (M_NOWAIT sector kmallocs / dmamap load failure) on a
host with the controller. Not reproducible on the audit guest.

## Impact ceiling
Permanent (unrecoverable) resource loss per event: AEN/param channels die;
CAM transactions hang with no completion path. DoS-grade degradation, gated on
allocation failure → Low.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.