# DF-4616 — ips_morpheus_poll computes its deadline in seconds but command->timeout counts 10-second watchdog ticks: the crash-dump poll window is 10× too short

## What
`sys/dev/raid/ips/ips.c:607-616`:

```c
void
ips_morpheus_poll(ips_command_t *command)
{
	uint32_t ts;

	ts = time_uptime + command->timeout;
	while (command->timeout != 0 &&
	    ips_morpheus_check_intr(command->sc) == 0 &&
	    (ts > time_uptime))
		DELAY(1000);
}
```

* `command->timeout` is set to `10` at issue time (`ips_issue_morpheus_cmd`,
  ips.c:601) and is decremented **once per 10-second watchdog tick** by
  `ips_timeout` (callout every `10 * hz`, ips.c:369, decrement at ips.c:342).
  Its unit is therefore "10-second ticks": a command is allowed ~100 s by the
  watchdog.
* `time_uptime` is **seconds**. `ts = time_uptime + 10` yields a deadline
  10 **seconds** in the future — a 10× unit mismatch.

`ips_morpheus_poll` is the synchronous-completion engine of the **crash-dump
path**: `ipsd_dump_map_sg` (ips_disk.c:322) calls `sc->ips_poll_cmd(command)`
immediately after issuing the write, with interrupts disabled — polling is
the *only* completion mechanism during a dump. When the controller takes
longer than 10 s (large dump block through a busy cache-flushing controller —
exactly the state a machine is in when it is crashing), the poll bails out
with the command still outstanding:

* `ipsd_dump_map_sg` returns as if the block had been written;
* the dump proceeds on an unacknowledged write → missing/garbage blocks in
  the crash dump (silent evidence corruption), or a dump that fails
  downstream when the command eventually completes into a dead kernel.

Also in the same function: `ips_morpheus_check_intr` is invoked **without
queue_lock** here (the real handler takes it, ips.c:585) — harmless in the
dump context where interrupts are off, but a latent race if any other caller
ever appears.

## Build / run
Requires a morpheus ServeRAID controller (0x1014:0x01BD) and a kernel crash
on a machine whose dump device is an ips volume. The audit guest has no such
hardware (`env.txt`).

## Contents
`VERDICT.md`, `env.txt`, `fix.diff`, `manifest.json`, `verdict.json`.