{
  "finding_id": "DF-4693",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Code-trace proven (twin of accepted DF-4503, ahci); hardware-gated on this guest: sili_pm_read (:657-668) and sili_pm_write (:698-703) call sili_ata_put_xfer() on ANY non-ATA_S_COMPLETE return. When the poll timeout defers because other commands are still on-chip (Deferred timeout until its safe, sili.c:2505-2511), sili_ata_cmd returns with xa->state==ATA_S_ONCHIP (sili.c:1357-1359,2375) - the CCB is recycled onto ap_ccb_free while the chip still owns the slot and ap_expired processing is pending. Detonations: sili_poll KKASSERT on slot reuse (sili.c:1321); sili_port_reinit later completes the recycled/reissued ccb (sili.c:403-411 -> 2393-2419) causing premature completion or stale sili_unload_prb of the new commands live dmamap (DF-4027 signature); stale ap_active bit wedges sili_exclusive_access forever (sili.c:1437-1443). Co-activity precondition holds: PM register traffic runs outside exclusive access on the EINFO/check_good paths (sili.c:530,580,654).",
  "exploit_chain": "",
  "evidence": "VERDICT.md trace steps 1-6 with the three detonation paths; run.log/env.txt document the hardware gate.",
  "kernel_refs": [
    "sys/dev/disk/sili/sili_pm.c:657-668",
    "sys/dev/disk/sili/sili_pm.c:698-703",
    "sys/dev/disk/sili/sili_pm.c:563-568",
    "sys/dev/disk/sili/sili.c:2350-2382",
    "sys/dev/disk/sili/sili.c:1311-1360",
    "sys/dev/disk/sili/sili.c:2488-2519",
    "sys/dev/disk/sili/sili.c:403-411",
    "sys/dev/disk/sili/sili.c:1437-1443"
  ],
  "poc_changes": "No seed; trigger written fresh (same shared program as DF-4692 pack).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o trigger_sili_pm trigger_sili_pm.c",
  "run_cmd": "./trigger_sili_pm 15",
  "code_hash": "d828da682541b4da49c76cad80f4c6c846db506937fe2ce219ce1d9a38d4591e",
  "notes": "Medium: panic common on INVARIANTS kernels; narrower cross-command corruption window; device-timing dependent (hung PM target + concurrent NCQ).",
  "recommended_fix": "Treat ATA_S_ONCHIP from sili_ata_cmd as deferred: wait for expiry processing to complete the xa before sili_ata_put_xfer.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not testable: the guest has no SiI 3124/3132 HBA and QEMU does not emulate the SiL3726 port multiplier, so neither baseline nor patched kernel can reach sili_pm_* at runtime. fix.diff is a line-accurate source-level fix (all referenced helpers declared in sili.h); code-reviewed only.",
  "fix_evidence": "env.txt (PCI inventory, 0 sili dmesg lines); fix.diff"
}