# VERDICT — DF-4692

**Status: inconclusive (hardware-gated) · code-path proven · expected impact: kernel panic (local DoS)**

## Reproduced?

No — and provably not runnable on this guest: the audit QEMU guest has **no
SiI 3124/3132 HBA** (PCI inventory in env.txt: PIIX3 IDE + virtio only, 7
devices) and QEMU does not emulate the SiL3726 port multiplier, so `sili(4)`
never attaches (`dmesg` has zero "sili" lines) and `sili_pm_*` is unreachable
at runtime. The trigger builds (build.log) and runs (run.log): 24+
XPT_RESET_DEV / rescan operations were driven against the only buses present
(ata0/ata1, nata driver) — benign, as expected when the sink is absent. This
is the same evidence standard as the accepted DF-4502/DF-4503 sibling packs.

## Why the defect is real (trace)

1. `sili_get_ccb()` — sili.c:2003-2018 — returns `TAILQ_FIRST(&ap->ap_ccb_free)`
   unchanged when the free list is empty, i.e. **NULL** is a designed return.
2. `sili_ata_get_xfer()` — sili.c:2317-2337 — propagates it:
   `if (ccb == NULL) { DPRINTF("NULL ccb"); return (NULL); }` (:2322-2327).
3. `sili_pm_set_feature()` — sili_pm.c:549-551:
   `xa = sili_ata_get_xfer(ap, &ap->ap_ata[15]); xa->fis->type = …` — no check.
4. `sili_pm_read()` — sili_pm.c:643-645 — same unchecked deref.
5. `sili_pm_write()` — sili_pm.c:680-682 — same unchecked deref.
   On NULL xa, `xa->fis` loads from ~offset 0x10 of the direct map →
   supervisor fault on the NULL page → kernel panic.

## Reachability of pool exhaustion on a PM port

The port-thread PM state machine issues `sili_pm_read(ap, 15, EINFO)` on every
hot-plug notification pass (sili.c:529-534) and `sili_pm_check_good()` performs
up to three further PM accesses per event (sili_pm.c:584, 589, 610). These run
under the port lock, but commands issued *before* the event still occupy slots
(ap_active). CAM I/O and PM maintenance are not mutually exclusive
(`sili_cam_action()` issues under `ap_sim_lock`, sili_cam.c:122/202), so a
saturated port (all SILI_MAXCMDS slots busy — e.g. NCQ depth against a PM with
several disks) plus one async-notify interrupt yields NULL at step 3/4/5.
`ata_xfer` has no reserved slot for PM maintenance (the err_ccb reservation is
only for error recovery, sili.c:2033-2050).

This is the same class as DF-4237 (sili_cam.c probe NULL deref, pass 1,
Medium) — three additional unchecked instances live in this file, including
the periodic EINFO poll that re-fires on every hot-plug event.

## Realistic impact ceiling

Kernel panic (unprivileged trigger: any user keeping the disks busy while a
hot-plug event / `camcontrol rescan` lands). No write primitive — NULL-page
read/write fault. Severity Medium, consistent with DF-4237.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.