{
  "finding_id": "DF-4701",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "likely",
  "verdict": "Source-proven shutdown state-machine defect: tw_cl_shutdown_ctlr (tw_cl_init.c:558-592) marks the controller inactive, lets the OSL tear down interrupts and cancel the watchdog, destroys the CL locks unconditionally (tw_cl_init.c:587-588) and only THEN learns the firmware shutdown handshake failed - and returns that error, so twa_detach (tw_osl_freebsd.c:813-815) aborts with the device still attached (CAM sim live, /dev/twa0 live). The only ctlr->active check in the driver is in the ISR (tw_cl_intr.c:81); twa_action (tw_osl_cam.c:357) and tw_cl_start_io/tw_cl_fw_passthru (tw_cl_io.c:70/261) submit every subsequent - including unprivileged - I/O to the dead controller with no self-healing path (watchdog cancelled). Not runtime-tested: requires a physical 3ware 9000-series HBA with wedged firmware; the audit QEMU guest has no 3ware PCI device and no /dev/twa (env.txt), so neither baseline nor fix validation is possible there. Impact ceiling: root-triggered broken state sustained as an unprivileged disk-volume DoS (CAM timeout storms) until reboot; debug-kernel lock assertions possible.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4701/VERDICT.md section 1-2 (line-by-line trace); README.md reproduction procedure; env.txt proves hardware absence on the guest (no 0x13C1 device, no /dev/twa*, no twa kld); fix.diff is git-apply --check clean against sys/",
  "kernel_refs": [
    "sys/dev/raid/twa/tw_cl_init.c:569",
    "sys/dev/raid/twa/tw_cl_init.c:574",
    "sys/dev/raid/twa/tw_cl_init.c:587",
    "sys/dev/raid/twa/tw_cl_init.c:591",
    "sys/dev/raid/twa/tw_osl_freebsd.c:813",
    "sys/dev/raid/twa/tw_osl_freebsd.c:853",
    "sys/dev/raid/twa/tw_osl_cam.c:357",
    "sys/dev/raid/twa/tw_cl_io.c:70",
    "sys/dev/raid/twa/tw_cl_io.c:261",
    "sys/dev/raid/twa/tw_cl_intr.c:81"
  ],
  "poc_changes": "No seed PoC existed. Authored trigger.sh as an on-hardware procedure (wedged fw -> kldunload abort -> unprivileged I/O) since the path is unreachable on the virtualized guest.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a - driver is in-tree; trigger requires 3ware hardware",
  "run_cmd": "sh findings/poc/DF-4701/trigger.sh (on a machine with a 3ware 9000-series controller)",
  "code_hash": "97321c10210c6c41921431ce0e33c6889329dbd3b1958eed1205e4e94c5e951a",
  "notes": "pass 2. Distinct from known DF-1814 (FREE_Q double-insert inside tw_cli_init_connection on submit_and_poll failure) and from DF-4335/DF-4509 (same class in get/set_param and drain_aen): those are request-queue corruption; this finding is the shutdown/teardown state machine and the missing liveness gate. Same-cause instance during system shutdown: twa_shutdown is the device_shutdown method (tw_osl_freebsd.c:202); CAM sync-cache flush CCBs issued after it are submitted to a closed connection. spin_uninit is a no-op on this tree (sys/sys/spinlock2.h), so lock-destruction itself is benign in production; the DoS stands via ctlr->active=FALSE with interrupts/watchdog gone and no entry-point gate.",
  "recommended_fix": "After tearing the CL down, tw_cl_shutdown_ctlr must return success (error stays a logged event) so detach completes; gate tw_cl_start_io/tw_cl_fw_passthru on ctlr->active (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-accurate source analysis and verified git-apply-clean against sys/; single-fix kernel build + baseline/patched runs require the physical 3ware controller, which the audit guest cannot provide (env.txt)",
  "fix_evidence": "findings/poc/DF-4701/fix.diff (git apply --check OK; never applied to sys/)"
}