# VERDICT — DF-4693

**Status: inconclusive (hardware-gated) · code-path proven · expected impact: kernel panic (KKASSERT) / cross-command CCB corruption / port wedge**

## Reproduced?

No — no sili(4) HBA on the audit guest and QEMU has no SiL3726 PM emulation
(env.txt). The trigger builds and runs (build.log / run.log) and drives the
CAM entry points (XPT_RESET_DEV, rescan) against the only buses present; the
defective code is unreachable at runtime here. Full control-flow proof below;
same evidence standard as the accepted DF-4503 sibling (ahci).

## Why the defect is real (trace)

1. `sili_pm_read()` / `sili_pm_write()` / `sili_pm_set_feature()` issue their
   FIS via `sili_ata_cmd()` — sili_pm.c:657 / 698 / 563.
2. Poll path: `sili_ata_cmd()` → `sili_poll(ccb, 1000, sili_ata_cmd_timeout)`
   — sili.c:2374-2375.
3. On timeout with the command on-chip, `sili_core_timeout()` sets
   `ap->ap_expired |= 1 << slot`; **if any other command is still active**
   (`ap->ap_active != ap->ap_expired`) it prints "Deferred timeout until its
   safe" and returns **without reinit** — sili.c:2502-2511. The xa state
   remains `ATA_S_ONCHIP`.
4. `sili_poll()` then returns `ccb->ccb_xa.state` — sili.c:1357-1359 — i.e.
   **ATA_S_ONCHIP**.
5. The PM accessors treat every non-`ATA_S_COMPLETE` return identically:
   error path → `sili_ata_put_xfer(xa)` — sili_pm.c:663-668 / 698-703 —
   which `sili_put_ccb()`s the ccb back onto `ap_ccb_free` with
   `state = ATA_S_PUT` (sili.c:2020-2030). **The chip still owns the slot;
   `ap_active`/`ap_expired` bits remain set.**
6. Detonations:
   - a new command takes the recycled slot → `sili_poll()`'s
     `KKASSERT((ap->ap_expired & (1 << ccb->ccb_slot)) == 0)` fires
     (sili.c:1321) → panic on INVARIANTS kernels (X86_64_GENERIC:56);
   - when the remaining commands finish, `sili_port_intr()` calls
     `sili_port_reinit()` (sili.c:1956-1958) which drains the expired slot:
     `ccb->ccb_xa.state = ATA_S_TIMEOUT; ccb->ccb_done(ccb);` (sili.c:403-411)
     → `sili_ata_cmd_done()` (sili.c:2393-2419) on a ccb that may already be
     re-issued for an unrelated command → premature completion / stale
     `sili_unload_prb()` of the *new* command's live dmamap (the DF-4027
     corruption signature);
   - if the slot never completes, the stale `ap_active` bit makes
     `sili_exclusive_access()` spin forever (sili.c:1437-1443) — permanent
     port-thread wedge.

## Co-activity precondition

PM register traffic runs **outside** exclusive access in exactly the paths
where other commands are on-chip: the port-thread EINFO poll (sili.c:530) and
`sili_pm_check_good()` (sili.c:580,654 → sili_pm.c:584,589,610). Only
`sili_pm_hardreset()` drains first (sili_pm.c:272). A hung or slow PM target
(1 s accessor timeout) while another target streams NCQ is the realistic
trigger — device-timing dependent, hence confidence "likely", matching
DF-4503's classification for the identical ahci defect.

## Impact ceiling

Kernel panic (common, INVARIANTS) with a narrower cross-command corruption
window (premature CAM completion / live-dmamap unload). Severity Medium.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.