# DF-4562 VERDICT — untested (speculative), Low, target-slot re-init race

## Bottom line

Speculative, labeled as such. `mpssas_add_device()`
(sys/dev/raid/mps/mps_sas_lsi.c:653-670) and `mpssas_volume_add()`
(:847-853) overwrite/`TAILQ_INIT` a target slot without checking
`MPSSAS_TARGET_INREMOVAL` / outstanding commands / `targ->tm`. Removal is
asynchronous (TM TARGET_RESET started in `mpssas_prepare_remove`,
mps_sas.c:449-466); a re-add event processed before the removal completes
would clear the flag under an outstanding TM and re-init lists that may
still be linked, corrupting the new list through stale `tqe_prev`
pointers on the completion path.

## Why not verified

The interleaving requires a real mps HBA delivering a re-add event inside
the removal window; the QEMU guest has no such hardware, and unlike
DF-4559/DF-4560 there is no deterministic arithmetic to replicate — the
claim is about event *timing*, not address math. Honest status: untested.
Filed (speculative) because pass-2 exists exactly for lifetime/error-path
interactions, and the neighboring removal defects DF-3895/DF-3898 do not
cover this sink.

## Impact if real

List corruption / lost commands on the storage path of one adapter —
availability-grade (DoS), possibly worse if the orphaned command blocks
are later double-completed. Not demonstrated.

## Recommended fix

Guard in add paths (see README): refuse to re-init a slot that is
INREMOVAL, has non-empty command lists, or an outstanding `tm`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.