{
  "finding_id": "DF-4694",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Code-trace proven; hardware-gated: sili_pm_softreset polls with sili_quick_timeout (sili_pm.c:450) whose ONCHIP branch asserts sole activity - KKASSERT((ap->ap_active & ~ap->ap_expired) == (1 << slot)) at sili.c:2537-2538 - but XPT_RESET_DEV enters sili_pm_softreset under the port lock only, without draining other PM targets on-chip commands (sili_cam.c:904-915 -> sili.c:744-745); contrast sili_pm_hardreset which drains via sili_exclusive_access (sili_pm.c:272). A softreset FIS timeout (1000/8000 ms) with any co-active command panics INVARIANTS kernels (X86_64_GENERIC:56, confirmed on guest); non-INVARIANTS builds force-reinit and abort the unrelated in-flight commands as ATA_S_TIMEOUT (sili.c:2540-2543 -> 403-411). Guest trigger drove 24+ camcontrol resets against ata0/ata1 benignly - no sili bus exists (env.txt).",
  "exploit_chain": "",
  "evidence": "VERDICT.md steps 1-4; run.log shows the XPT_RESET_DEV driver running; env.txt the hardware gate; INVARIANTS confirmed in guest /usr/src/sys/config/X86_64_GENERIC:56.",
  "kernel_refs": [
    "sys/dev/disk/sili/sili_pm.c:445-457",
    "sys/dev/disk/sili/sili.c:2527-2548",
    "sys/dev/disk/sili/sili_cam.c:904-915",
    "sys/dev/disk/sili/sili.c:733-750",
    "sys/dev/disk/sili/sili_pm.c:272"
  ],
  "poc_changes": "No seed; trigger written fresh (camcontrol reset storm is the XPT_RESET_DEV driver).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o trigger_sili_pm trigger_sili_pm.c",
  "run_cmd": "./trigger_sili_pm 15",
  "code_hash": "d828da682541b4da49c76cad80f4c6c846db506937fe2ce219ce1d9a38d4591e",
  "notes": "Medium: panic on default-config kernels with PM hardware; non-INVARIANTS variant silently aborts unrelated I/O.",
  "recommended_fix": "Drain co-active commands (sili_exclusive_access) before the softreset poll, mirroring sili_pm_hardreset; downgrade the KKASSERT.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not testable: the guest has no SiI 3124/3132 HBA and QEMU does not emulate the SiL3726 port multiplier, so neither baseline nor patched kernel can reach sili_pm_* at runtime. fix.diff is a line-accurate source-level fix (all referenced helpers declared in sili.h); code-reviewed only.",
  "fix_evidence": "env.txt (PCI inventory, 0 sili dmesg lines); fix.diff"
}