# DF-4692 — sili_pm: sili_pm_read / sili_pm_write / sili_pm_set_feature dereference unchecked sili_ata_get_xfer() NULL — kernel panic on ccb-pool exhaustion

## Build & run

```
sh build.sh          # cc -O2 -Wall -o trigger_sili_pm trigger_sili_pm.c
sh run.sh            # ./trigger_sili_pm 15  (camcontrol reset/rescan storm)
```

## Expected output

* **On hardware with a SiI 3124/3132 HBA + SiL3726 PM, port saturated with
  I/O:** any hot-plug async-notify event (or the periodic PM state machine
  pass) makes the port thread call `sili_pm_read(ap, 15, SATA_PMREG_EINFO, …)`
  (sili.c:530) / `sili_pm_check_good()` (sili.c:580,654 → sili_pm.c:584,589,610).
  With every command slot busy, `sili_ata_get_xfer()` returns NULL
  (sili.c:2322-2327) and `xa->fis->type = …` (sili_pm.c:645) faults the NULL
  direct-map page → kernel panic.
* **On the audit QEMU guest:** trigger builds and runs to completion against
  ata0/ata1 (no sili HBA exists; see env.txt) — the defective code is never
  reached. This is a hardware gate, not a false positive.

## Root cause chain (path:line)

1. `sili_get_ccb()` returns NULL when `ap_ccb_free` is empty — sili.c:2008-2014.
2. `sili_ata_get_xfer()` propagates the NULL — sili.c:2322-2327.
3. `sili_pm_set_feature()` dereferences without check — sili_pm.c:549-551.
4. `sili_pm_read()` dereferences without check — sili_pm.c:643-645.
5. `sili_pm_write()` dereferences without check — sili_pm.c:680-682.
6. Live entries: PM hot-plug state machine EINFO poll (sili.c:530),
   `sili_pm_check_good()` (sili_pm.c:584,589), `sili_pm_identify()`
   (sili_pm.c:170-217), `sili_pm_hardreset()` (sili_pm.c:283-340).

Same defect class as DF-4237 (sili_cam.c, pass 1) — three further unchecked
instances in this file.