# DF-4503 — ahci_pm_read/write recycle an on-chip ata_xfer after deferred timeout

ahci_pm_read()/ahci_pm_write() call ahci_ata_put_xfer() on ANY
non-COMPLETE return. When the poll timeout DEFERS ("Deferred timeout
until its safe", ahci.c:3881) because co-issued commands are still
active — possible on FBSS-enabled PM ports, where PM register commands
run outside exclusive access and the issue limit is 2-4 — ahci_ata_cmd()
returns with xa->state == ATA_S_ONCHIP: the command is still programmed
on the chip while its CCB is recycled to the free list. The later
completion/expiry hits a CCB in ATA_S_PUT or re-issued to another
command → KKASSERT panic (ahci_ata_cmd_done, ahci.c:3775) or
cross-command completion corruption.

## Reproduce (PM + FBS hardware required)

```
build.sh                                   # builds trigger_DF4503
./trigger_DF4503 /dev/da1 600 &            # keep a PM target disk busy
while :; do camcontrol rescan <bus>; sleep 1; done   # notify storm
```

## Expected output (vulnerable)

```
...: CMD TIMEOUT state=2 slot=N ... Deferred timeout until its safe, slot N
assertion "xa->state != ATA_S_ONCHIP && xa->state != ATA_S_PUT" failed in ahci_ata_cmd_done
```

## On the audit guest

No AHCI controller (PIIX3 IDE + virtio only); QEMU has no PM/FBS
emulation → build + load-generator verified only (build.log, run.log).
Full line-cited control-flow proof in VERDICT.md.