# VERDICT — DF-4695

**Status: inconclusive (hardware-gated) · defect mechanically certain from source · impact: probe-logic degradation, no memory-safety effect**

## Reproduced?

Runtime manifestation requires sili PM hardware (absent on the guest,
env.txt), but this finding does not need runtime proof: the defect is a
mechanically provable dead store.

## Proof

`sili_pm.c:489-499` (verbatim):

```c
	if (at->at_type == ATA_PORT_T_NONE) {
		at->at_type = sili_port_signature(ap, at, sig);       // :490
	} else {
		if (sili_port_signature(ap, at, sig) != at->at_type) { // :492
			kprintf("%s: device signature unexpectedly "
				"changed\n", ATANAME(ap, at));
			error = EBUSY; /* XXX */                       // :495
		}
	}
	error = 0;                                                  // :498
err:
	…
	at->at_probe = error ? ATA_PROBE_FAILED : ATA_PROBE_NEED_IDENT; // :515
```

`error` is initialized to EIO at :422; the only way it can be EBUSY at :497
is the signature-change branch at :495 — and :498 unconditionally overwrites
it with 0. Hence `error = EBUSY` is dead: the signature-change condition is
detectable only from the console message, never from the return value.

## Consequence

When a softreset run as part of ccb error processing sees the device
signature change (device swapped / glitched behind the PM), the caller —
`sili_port_reset()` from the state machine (sili.c:632) or XPT_RESET_DEV
(sili_cam.c:908) — is told success. `at->at_probe` advances to
`ATA_PROBE_NEED_IDENT` (:515) with `at->at_type` still holding the **old**
device type (the else-branch never updates it), so the subsequent probe
issues the IDENTIFY variant for the wrong device class; the mis-probe fails
and degrades to a logged probe failure instead of the intended orderly EBUSY
retry. No memory corruption; wasted probe cycles and a wrong-type window
during device replacement. Severity Low, confidence certain.

## Family note

The ahci twin carries the identical defect — ahci_pm.c:853-856 (`error =
EBUSY; /* XXX */` … `error = 0;`). ahci_pm.c is outside this file's scope;
flagged here for the orchestrator.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.