# DF-4639 VERDICT — reproduced (logic inversion on live default; hardware end-to-end not observable on guest)

## The claim

`ips_send_flush_request` (sys/dev/raid/ips/ips_commands.c:195-220) contains a
debug tunable whose polarity is inverted, so the **default** configuration
drops every BUF_CMD_FLUSH instead of forwarding it to the adapter as a
IPS_CACHE_FLUSH_CMD.

## Proof chain

1. **Default value is 0.**
   - Source: `ips_commands.c:35-36` — `static int ips_debug_ignore_flush_cmd;`
     + `TUNABLE_INT("debug.ips.ignore_flush_cmd", ...)` (BSS ⇒ 0).
   - Live guest: `sysctl debug.ips.ignore_flush_cmd` → **0** (run.log; the
     ips driver is compiled into the guest's X86_64_GENERIC kernel).

2. **Dispatch reaches the function for every flush bio.**
   `ipsd_strategy` (ips_disk.c:128-140) queues the bio and calls
   `ips_start_io_request` (ips_commands.c:237-253), which at :249 branches
   `b_cmd == BUF_CMD_FLUSH` → `ips_send_flush_request` (:250).

3. **The branch skips the adapter command at flag==0.**
   `ips_commands.c:202-206`:
   ```c
   if (!ips_debug_ignore_flush_cmd) {
           ips_insert_free_cmd(sc, command);
           ipsd_finish(bio);          /* completed, NO B_ERROR set */
           return 0;
   }
   ```
   The real command build (`flush_cmd->command = IPS_CACHE_FLUSH_CMD;` :210)
   and issue (`sc->ips_issue_cmd(command)` :218) are only reachable when the
   flag is SET (1).

4. **Documented semantics are the opposite.**
   `ips_commands.c:38-40`: SYSCTL description
   `"Do not issue IPS_CACHE_FLUSH_CMD on BUF_CMD_FLUSH"` — i.e. flag SET ⇒
   skip. FreeBSD upstream has no such tunable (the whole flush-request block
   is DragonFly-added; verified against freebsd-src ips_commands.c HEAD —
   no `ignore_flush_cmd`/`ips_send_flush_request` there), so this is
   DF-introduced, not inherited.

5. **Harness run (guest, unprivileged user maxx):** the exact branch
   extracted verbatim into `flush_invert_harness.c` —
   `flag=0 → adapter_cmds_issued=0, bio_finished=1 (no error)`;
   `flag=1 → adapter_cmds_issued=1, last_opcode=0x0A (IPS_CACHE_FLUSH_CMD)`.
   Exit marker 42. See run.log.

## What was and was not reproduced

- REPRODUCED: the inverted control flow itself, at the live kernel's default
  flag value, from an unprivileged account (the harness is exact-logic; the
  sysctl default is read from the running kernel).
- NOT observable on this guest: the on-the-wire adapter command. The guest
  has zero ServeRAID PCI devices and QEMU has no ips device model
  (env.txt: 0 matches for vendor 0x1014/0x9005; /dev/ips* absent), so the
  path cannot be instantiated with hardware. The consequence — fsync() data
  lying in the adapter cache — follows mechanically from the proven branch.

## Fix validation

`fix.diff` flips the condition to `if (ips_debug_ignore_flush_cmd)` so the
skip path only runs when the operator explicitly asks for it. An A/B kernel
run cannot change the observable (the branch is proven by harness either
way; the end-to-end effect needs hardware), so
`fix_status: not_testable`, `fix_baseline_reproduced: 1`,
`fix_patched_reproduced: 0`.

## Related

- DF-4613..4616 (ips.c watchdog/queue/reinit/dump) — adjacent ips family,
  all distinct root causes.
- No other consumer of `ips_debug_ignore_flush_cmd` exists
  (`rg ignore_flush sys/` → ips_commands.c only).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.