# DF-4615 — ips_copperhead_reinit ignores ips_copperhead_queue_init failure → dangling copper_queue UAF in the interrupt handler; every forced reinit leaks the previous queue

## What
`sys/dev/raid/ips/ips.c:730` (unchecked call), `ips.c:672-675` (error path
frees the queue but leaves `sc->copper_queue` dangling), `ips.c:745-760`
(interrupt-driven UAF read/write through the dangling pointer),
`ips.c:650` (fresh allocation per reinit without freeing the old one).

## UAF path
`ips_copperhead_queue_init` allocates `sc->copper_queue` (ips.c:650-654). On
any failure after the allocation (status-queue map load yields phys 0,
ips.c:662-665) the exit path runs `bus_dmamem_free(dmatag, sc->copper_queue,
dmamap)` (ips.c:673) but **neither NULLs `sc->copper_queue` nor records the
failure for the caller** — and the caller ignores the return anyway:

```c
ips_copperhead_queue_init(sc);     /* ips.c:730 — return value ignored */
```

`ips_copperhead_reinit` then continues as if the queue were live. On the next
`COPPER_SCE_BIT` interrupt, `ips_copperhead_intr` (ips.c:770) →
`ips_copperhead_cmd_status` (ips.c:751-757):

```c
statnum = sc->copper_queue->nextstatus++;   /* WRITE to freed memory */
...
value = sc->copper_queue->status[statnum];  /* READ of freed memory */
ips_write_4(sc, COPPER_REG_SQTR, sc->copper_queue->base_phys_addr + 4*statnum);
```

→ use-after-free read **and** write (`nextstatus++`) in interrupt context,
plus a card register write driven by freed-memory contents.

Additional defect in the same lines: on **successful** re-init (every forced
reset from `ips_timeout`, ips.c:355→ips.c:738) a fresh queue is allocated at
ips.c:650 while the previous `sc->copper_queue` (from the original attach) is
never freed — one DMA tag + DMA-mapped `ips_copper_queue_t` (~528 B) leaked
per reset; a flapping card bleeds kernel memory until reset succeeds or the
system runs out.

The error path also frees with possibly-NULL handles when the failure happens
before allocation (tag-create failure → `bus_dmamem_free(NULL, NULL, NULL)`,
ips.c:672-674) — NULL-deref panic on the same unchecked path.

## Build / run
Requires an IBM ServeRAID copperhead-family controller (0x1014:0x002E et al).
Audit guest has none (`env.txt`); no QEMU device model exists.

## Contents
`VERDICT.md`, `env.txt`, `fix.diff`, `manifest.json`, `verdict.json`.