{
  "finding_id": "DF-4403",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Certain from source, hardware/allocation-failure gated. (1) tws_send_scsi_cmd (:842-844), tws_set_param (:870-872) and tws_get_param (:919-921) strand reserved slots reqs[1]/reqs[3] in TWS_REQ_STATE_BUSY when their sector kmalloc fails \u2014 reserved slots are gated by state alone (tws.c:749-789, 631-632), so the AEN fetch channel and the parameter channel die permanently (get_params slot even has cb==NULL at :924, so nothing can ever complete it). (2) tws_execute_scsi (:807-810) returns tws_map_request failure to tws_action (:271, trace only) without xpt_done and without releasing the slot; the request was never submitted so it is on no queue (BUSY_Q insert happens only in tws_submit_command, tws_hdm.c:326-330) and even the reset drain (tws_cam.c:616-643) can never complete the ccb \u2014 permanent CAM transaction hang plus slot leak, and the pre-armed callout turns the software failure into a full controller reset. Guest lacks the HBA; each path proven from source in VERDICT.md.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (per-path proof); fix.diff (free reserved slots on alloc failure; complete+release ccb on map failure); trigger.c (conditions)",
  "kernel_refs": [
    "sys/dev/raid/tws/tws_cam.c:842",
    "sys/dev/raid/tws/tws_cam.c:870",
    "sys/dev/raid/tws/tws_cam.c:809",
    "sys/dev/raid/tws/tws.c:763",
    "sys/dev/raid/tws/tws_hdm.c:326"
  ],
  "poc_changes": "no seed; conditions stub only",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -o trigger trigger.c",
  "run_cmd": "n/a \u2014 requires kmalloc/dmamap failure on a host with the controller",
  "notes": "Error-path resource-lifetime class; permanent (unrecoverable) leaks, DoS-grade degradation gated on memory pressure.",
  "recommended_fix": "Return reserved slots to FREE state on allocation failure and complete+release the ccb when tws_map_request fails in tws_execute_scsi.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the missing unwind on all four paths; not validatable on the guest (no controller, uncontrollable allocation failure).",
  "fix_evidence": "fix.diff",
  "code_hash": "26e59c2a589074d33548898c4a734b45f898fd7a5d8ae30c5c7d1cd71a62f542"
}