{
  "finding_id": "DF-4503",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "ahci_pm_read() (ahci_pm.c:976-1001) and ahci_pm_write() (ahci_pm.c:1013-1036) call ahci_ata_put_xfer() on ANY non-ATA_S_COMPLETE return. When ahci_poll()s timeout handler defers because co-issued commands are still active (\"Deferred timeout until its safe\", ahci.c:3873-3884), ahci_ata_cmd() returns with xa->state == ATA_S_ONCHIP (ahci.c:2183) -- the command is still programmed on the chip -- and the PM accessors then recycle the CCB into ap->ap_ccb_free (ahci.c:3316-3328). The eventual chip completion or deferred-expiry processing (ahci.c:3894-3910) operates on a CCB in ATA_S_PUT (KKASSERT panic at ahci.c:3775 on INVARIANTS kernels) or re-issued to an unrelated command (cross-command completion corruption: state overwrite at ahci.c:3899, premature done/complete). Co-activity requires an FBSS-enabled PM port (issue limit 2-4, ahci.c:2426-2433) and PM register commands running outside exclusive access (state machine: ahci.c:841, 891 vs the exclusive bracket at 938); PM writes carry no exclusivity flags at all (ahci_pm.c:1028) and PM reads get followers appended after the AUTOSENSE leader by the issue loop (ahci.c:2458-2466). Runtime reproduction impossible on the audit guest: no AHCI controller (env.txt) and QEMU does not emulate port multipliers or FBS. Load-half trigger builds and runs (build.log/run.log); full control-flow proof in VERDICT.md. Expected real-hardware impact: kernel panic (common) with a narrower cross-command corruption window; classified likely (code path proven, hardware timing window unmeasurable here).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-cited proof: deferral condition ahci.c:3873-3884 vs the unconditional put at ahci_pm.c:1000/1035; the FBSS co-issue analysis ahci.c:2339-2358/2424-2467); run.log (load generator executes); env.txt (no AHCI on guest); fix.diff (git-apply --check OK)",
  "kernel_refs": [
    "sys/dev/disk/ahci/ahci_pm.c:976-1001",
    "sys/dev/disk/ahci/ahci_pm.c:1013-1036",
    "sys/dev/disk/ahci/ahci.c:2137-2184",
    "sys/dev/disk/ahci/ahci.c:3316-3328",
    "sys/dev/disk/ahci/ahci.c:3749-3780",
    "sys/dev/disk/ahci/ahci.c:3811-3930",
    "sys/dev/disk/ahci/ahci.c:841",
    "sys/dev/disk/ahci/ahci.c:891",
    "sys/dev/disk/ahci/ahci.c:938",
    "sys/dev/disk/ahci/ahci.c:2339-2358",
    "sys/dev/disk/ahci/ahci.c:2424-2467"
  ],
  "poc_changes": "No seed sketch; wrote the I/O-load trigger from scratch (built first try on the guest). The notify-storm half is the camcontrol rescan loop documented in run.sh.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o trigger_DF4503 trigger_DF4503.c",
  "run_cmd": "./trigger_DF4503 /dev/vbd0s1d 2   (load-half smoke test)",
  "code_hash": "30b491392d3a160b72df8126a13b34c05bd7458c2efe3f2351d937c8740947e4",
  "notes": "Distinct from DF-1659/DF-2423 (NULL-deref on get_xfer failure in the same functions): here the xfer is acquired successfully and recycled while still owned by the chip -- a lifecycle/UAF-class defect, not a NULL deref. The deeper enabling quirk (issue loop appending followers after an EXCLUSIVE/AUTOSENSE leader, ahci.c:2458-2466) is flagged for upstream but out of this files diff scope.",
  "recommended_fix": "Never recycle an ata_xfer whose state is still ATA_S_ONCHIP: run PM register commands through a helper that drives the deferred-timeout machinery until the command comes off the chip before ahci_ata_put_xfer() (see fix.diff); upstream should additionally fix the inverted exclusivity break at ahci.c:2458-2466.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix authored (fix.diff introducing ahci_pm_cmd() drain helper; git-apply --check clean) but not kernel-buildable into a testable configuration: requires FBSS-capable PM hardware absent from all available emulation (guest has no AHCI controller; QEMU has no PM/FBS emulation), so baseline-vs-patched comparison cannot be performed.",
  "fix_evidence": "fix.diff (git apply --check OK on the read-only sys/ tree; never applied); VERDICT.md Fix validation section."
}