# DF-4502 — ahci_pm_softreset error-CCB reservation leak

ahci_pm_softreset() (sys/dev/disk/ahci/ahci_pm.c:805-817) releases the
reserved error CCB only when it retries; on the FINAL second-FIS failure
it jumps to err: with the reservation still held. AP_F_ERR_CCB_RESERVED
stays set forever and ap_active/ap_sactive/ap_active_cnt stay zeroed →
the port wedges (no new commands issued) and the next ahci_get_err_ccb()
on the port KKASSERT-panics INVARIANTS kernels (X86_64_GENERIC included).

## Reproduce (PM hardware required)

```
build.sh                 # cc -O2 -Wall -o trigger_DF4502 trigger_DF4502.c
run.sh <cam-bus>         # 64 x camcontrol rescan <bus>  (root)
```

- **Primed** by: a PM target failing the 2nd SRST FIS twice in a row
  (device-driven; console shows "Soft-reset(2) through PM failed,
  retrying" then "... giving up").
- **Detonated** by: any later port reset/probe (hotplug, rescan) →
  `panic: assertion "(ap->ap_flags & AP_F_ERR_CCB_RESERVED) == 0" failed`.

## Expected output (vulnerable, primed)

Kernel panic as above; without INVARIANTS the port silently hangs all
I/O ("DELAY CCB" console spew) instead.

## On the audit guest

No AHCI controller exists (PIIX3 IDE + virtio only) and QEMU does not
emulate port multipliers → build + CAM plumbing verified (build.log,
run.log), bug path not runtime-reachable. See VERDICT.md for the full
line-cited trace.