# DF-4607 VERDICT

## Status: not_reproduced — impact class: UAF/double-free (memcorrupt)

The race is a code-level certainty (unlocked DANGER1/DANGER2 transitions in
ata-queue.c:308-317 executed from two concurrent contexts — the waiter's
direct call at :150 and the taskqueue completion via ata_finish), and the
memory-safety consequence chain (concurrent body execution → zombie
ata_free_request at :313 while the other thread is mid-body → caller's
ata_free_request at :182/:209 on the zeroed object → double objcache_put)
follows mechanically from ata-all.h:605-611.

What could not be produced on the audit guest is the *precondition*: a
request that survives 4×timeout (40 s) without completing and whose real
completion then lands inside the direct call's window. Guest measurement
(stress.log): the QEMU-backed channel moves 512 MB in 0.69 s; kernel log
shows zero ata timeout/DANGER messages under the stress. There is no
in-guest dial (user or root) to stall the emulated PIIX3 controller for 40
seconds, so the interleave cannot be staged honestly. Marked
not_reproduced rather than speculative because the only missing ingredient
is timing under hardware distress, which is the normal real-world trigger
for this path (failing disks, lost interrupts, taskqueue starvation).

## Fix

See fix.diff: guard the DANGER transitions + zombie free with the request's
done lock and early-out on ATA_R_COMPLETED so the body executes at most
once per submission. fix_status=not_testable for the same precondition
reason (baseline not stageable on this guest).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.